EUVD-2026-29637
GHSA-x84h-h468-6jpc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid low-privilege SharePoint credentials
-
DeliveryReach vulnerable SharePoint endpoint over network
-
ExploitSend crafted serialized .NET payload
-
ExecutionServer deserializes untrusted object (CWE-502)
-
PersistExecute gadget chain in worker process
-
ImpactFull compromise of SharePoint server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to possess valid authentication to the target SharePoint farm (CVSS PR:L - a low-privileged authorized user, not anonymous access) and network reachability to the SharePoint web application; the attack targets on-premises SharePoint Enterprise Server 2016, Server 2019, or Subscription Edition below the fixed builds. No user interaction is needed (UI:N) and complexity is low (AC:L). The primary limiting factors are the authentication requirement and that only on-premises server SKUs are in scope - SharePoint Online is not listed among affected products - so risk is concentrated in organizations running unpatched self-hosted farms with broad user access. |
| Impact | The signals are consistent but point to a real-but-not-yet-urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with total impact on the vulnerable system. However, CISA SSVC assesses Exploitation as none and Automatable as no (despite Technical Impact = total), and EPSS is only 0.50% (66th percentile), so there is no evidence of active or automated exploitation. This is NOT a KEV-listed zero-day; the PR:L requirement (any authenticated farm user) is the main gate - it lowers real-world risk versus an unauthenticated RCE but remains dangerous in environments where broad user access to SharePoint is normal. Because a vendor patch already exists, treat as a prompt-but-schedulable patch, prioritizing internet-exposed farms. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged SharePoint account (or has phished/reused one) sends a crafted HTTP request containing a malicious serialized .NET object to a vulnerable SharePoint endpoint. The server deserializes the payload without type validation, triggering a gadget chain that executes attacker code in the web worker process, yielding full server compromise. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) allows an authenticated attacker to run arbitrary code over the network by supplying maliciously crafted serialized data (CWE-502). Any user holding valid low-privilege credentials on the SharePoint farm can achieve total compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as none; EPSS is a modest 0.50% (66th percentile).
RemediationAI
Vendor-released patch: apply the Microsoft security updates that raise the build to at least 16.0.5552.1002 (Enterprise Server 2016), 16.0.10417.20128 (Server 2019), or 16.0.19725.20280 (Server Subscription Edition), as directed by the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35439. Because SharePoint updates require running the SharePoint Products Configuration Wizard (or PSConfig) across all farm servers after installation, schedule a maintenance window and patch every server in the farm to avoid version-mismatch failures. Until patching completes, reduce exposure by removing the affected servers from direct internet reachability, tightening authenticated access so only trusted accounts can reach SharePoint web applications (this flaw requires only PR:L, so limiting who holds valid credentials directly shrinks the attack surface - at the cost of restricting legitimate collaboration), and monitoring w3wp.exe for anomalous child-process spawns indicative of deserialization gadget execution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-502 unsafe deserialization of untrusted data within the SharePoint server-side object/request processing pipeline. SharePoint is built on the .NET/ASP.NET stack and historically has been vulnerable to insecure BinaryFormatter/type-confusion style deserialization, where attacker-controlled serialized payloads are reconstituted into live objects without adequate type validation, triggering gadget-chain code execution in the w3wp.exe worker process context. Per the CPE data the exact affected platforms are microsoft:microsoft_sharepoint_enterprise_server_2016, microsoft:microsoft_sharepoint_server_2019, and microsoft:microsoft_sharepoint_server_subscription_edition - all on-premises server SKUs, not SharePoint Online.
Know when Microsoft Sharepoint Enterprise Server 2016 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable deserialization needs only low-privileged authentication (PR:L) and no interaction; successful RCE yields total impact, so C/I/A all High with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Executive ViewAI
A remote code execution vulnerability in Microsoft SharePoint (2016, 2019, and Subscription Edition) allows any authenticated user to gain complete control over SharePoint systems, compromising all stored data and collaboration infrastructure. Exploitation requires only low-privilege user credentials, making this a critical risk for organizations where SharePoint is widely accessible to employees or contractors.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Improper input validation in Microsoft SharePoint Server enables network-based spoofing attacks without authentication,
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Exploit-DB