EUVD-2026-29577
GHSA-8g6p-9h2c-j3gp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity deserialization needing a valid low-privileged SharePoint account (PR:L) and no user interaction, yielding full code execution and total C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) allows an authenticated attacker (PR:L) to run arbitrary code over the network by submitting maliciously crafted serialized data that the server deserializes without validation. Microsoft has released a patch and no public exploit identified at time of analysis; EPSS is modest at 0.50% (66th percentile) and CISA SSVC rates exploitation as 'none' but technical impact as 'total'. The bug follows the well-known SharePoint deserialization RCE pattern (CWE-502), making it a high-value target for post-authentication lateral movement and full server compromise.
Technical ContextAI
SharePoint is Microsoft's on-premises collaboration and document-management platform built on ASP.NET and the .NET Framework, which relies heavily on object serialization (e.g., BinaryFormatter/ObjectStateFormatter/LosFormatter and related .NET serializers) to persist and transport control state and workflow data. The root cause is CWE-502, Deserialization of Untrusted Data: the application reconstructs .NET objects from attacker-influenced serialized input without adequately validating the type or content, allowing a crafted gadget chain to trigger code execution during or after deserialization. The affected CPEs are cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, cpe:2.3:a:microsoft:microsoft_sharepoint_server_2019, and cpe:2.3:a:microsoft:microsoft_sharepoint_server_subscription_edition, all server-side on-premises SKUs where the vulnerable code runs in the context of the SharePoint/IIS application pool identity.
RemediationAI
Apply the Microsoft security update referenced in MSRC advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33112 as the primary fix, upgrading to at least SharePoint Subscription Edition 16.0.19725.20280, SharePoint Enterprise Server 2016 16.0.5552.1002, or SharePoint Server 2019 16.0.10417.20128 depending on your deployment; SharePoint updates typically require running the SharePoint Products Configuration Wizard (PSConfig) on each farm server after installing the binaries, so schedule a maintenance window because the farm may be temporarily offline. Where immediate patching is not possible, reduce exposure by removing SharePoint from direct internet reachability (place it behind VPN or a reverse proxy with strict authentication), enforcing least-privilege on SharePoint accounts to shrink the pool of authenticated users who could exploit PR:L, and monitoring for anomalous serialized payloads or unexpected w3wp.exe/child-process activity; note these controls limit but do not eliminate risk since any valid authenticated user remains a potential vector. Confirm AMSI integration for SharePoint is enabled if supported in your version, as it can block some deserialization exploit payloads at runtime with minimal operational side effects.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today