EUVD-2026-29639
GHSA-9wcj-vxr2-vvvh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable deserialization RCE needing only authenticated low-privilege access (PR:L) and no user interaction; code execution yields total C/I/A impact within the SharePoint service scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Edition) allows an authenticated attacker to run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). An authorized user holding only low-level site privileges can escalate to full server compromise over the network with no user interaction. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none'; EPSS sits at 0.50% (66th percentile), indicating modest near-term exploitation probability despite the high CVSS 8.8 score.
Technical ContextAI
The flaw is a CWE-502 unsafe deserialization of untrusted data within Microsoft Office SharePoint Server, a widely deployed .NET-based collaboration and document-management platform. SharePoint historically processes serialized objects (e.g., via BinaryFormatter/ObjectStateFormatter, view-state, or workflow payloads); when such data from an authenticated request is deserialized without adequate type validation, an attacker-supplied gadget chain can be reconstructed into live objects that trigger code execution during deserialization. The CPE data confirms three affected on-premises server products - cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, microsoft_sharepoint_server_2019, and microsoft_sharepoint_server_subscription_edition - rather than SharePoint Online.
RemediationAI
Apply the Microsoft security update per the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40357). Vendor-released patched builds: upgrade SharePoint Server Subscription Edition to 16.0.19725.20280 or later, SharePoint Server 2019 to 16.0.10417.20128 or later, and SharePoint Enterprise Server 2016 to 16.0.5552.1002 or later. Because exploitation requires authenticated access, compensating controls until patching completes include restricting SharePoint access to trusted networks/VPN and tightening site-collection permissions to minimize low-privilege and self-registering accounts (trade-off: may disrupt legitimate collaboration and external sharing); placing the farm behind a WAF/reverse proxy that inspects and blocks anomalous serialized payloads to internal SharePoint endpoints (trade-off: signature coverage for novel gadget chains is imperfect); and rotating/monitoring credentials plus enabling ULS and IIS request logging to detect anomalous authenticated POSTs (trade-off: detection only, not prevention). Run the standard SharePoint post-patch PSConfig/upgrade steps so the update fully applies across every farm server.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today