EUVD-2026-29637
GHSA-x84h-h468-6jpc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable deserialization needs only low-privileged authentication (PR:L) and no interaction; successful RCE yields total impact, so C/I/A all High with unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) allows an authenticated attacker to run arbitrary code over the network by supplying maliciously crafted serialized data (CWE-502). Any user holding valid low-privilege credentials on the SharePoint farm can achieve total compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as none; EPSS is a modest 0.50% (66th percentile).
Technical ContextAI
The flaw is a CWE-502 unsafe deserialization of untrusted data within the SharePoint server-side object/request processing pipeline. SharePoint is built on the .NET/ASP.NET stack and historically has been vulnerable to insecure BinaryFormatter/type-confusion style deserialization, where attacker-controlled serialized payloads are reconstituted into live objects without adequate type validation, triggering gadget-chain code execution in the w3wp.exe worker process context. Per the CPE data the exact affected platforms are microsoft:microsoft_sharepoint_enterprise_server_2016, microsoft:microsoft_sharepoint_server_2019, and microsoft:microsoft_sharepoint_server_subscription_edition - all on-premises server SKUs, not SharePoint Online.
RemediationAI
Vendor-released patch: apply the Microsoft security updates that raise the build to at least 16.0.5552.1002 (Enterprise Server 2016), 16.0.10417.20128 (Server 2019), or 16.0.19725.20280 (Server Subscription Edition), as directed by the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35439. Because SharePoint updates require running the SharePoint Products Configuration Wizard (or PSConfig) across all farm servers after installation, schedule a maintenance window and patch every server in the farm to avoid version-mismatch failures. Until patching completes, reduce exposure by removing the affected servers from direct internet reachability, tightening authenticated access so only trusted accounts can reach SharePoint web applications (this flaw requires only PR:L, so limiting who holds valid credentials directly shrinks the attack surface - at the cost of restricting legitimate collaboration), and monitoring w3wp.exe for anomalous child-process spawns indicative of deserialization gadget execution.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today