EUVD-2026-29650
GHSA-x3r3-x95v-wx99
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Network-reachable deserialization needs a valid low-privilege SharePoint account (PR:L) but the attacker submits their own payload, so UI:N; total compromise gives C:H/I:H/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated attacker with low-level site privileges to run arbitrary code across the network by submitting maliciously crafted serialized data (CWE-502). Microsoft has released a patch; there is no public exploit identified at time of analysis, and the EPSS score is low (0.31%, 55th percentile), with CISA's SSVC framework rating exploitation status as 'none' but technical impact as 'total'. The combination of authenticated-but-low privilege access and full compromise of confidentiality, integrity, and availability makes this a meaningful escalation-to-RCE risk in enterprise collaboration environments.
Technical ContextAI
The vulnerability is a CWE-502 deserialization of untrusted data flaw in Microsoft's on-premises SharePoint Server platform, an ASP.NET/.NET-based enterprise collaboration and document management product. SharePoint historically processes serialized .NET objects (e.g., via BinaryFormatter, LosFormatter, or ViewState/__VIEWSTATE handling and workflow/InfoPath payloads); when such data is deserialized without type validation, an attacker can supply a crafted object graph that instantiates gadget chains during deserialization, leading to code execution in the context of the SharePoint application pool. The affected CPEs are cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, cpe:2.3:a:microsoft:microsoft_sharepoint_server_2019, and cpe:2.3:a:microsoft:microsoft_sharepoint_server_subscription_edition, confirming this affects on-premises SharePoint rather than SharePoint Online.
RemediationAI
Apply the Microsoft security update for your edition and upgrade to at least the fixed build: SharePoint Enterprise Server 2016 to 16.0.5552.1002 or later, SharePoint Server 2019 to 16.0.10417.20128 or later, and SharePoint Server Subscription Edition to 16.0.19725.20280 or later, following the guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40368 (Vendor-released patch: builds listed above). SharePoint cumulative updates typically require applying the update package to all farm servers and then running the SharePoint Products Configuration Wizard (PSConfig) to complete the upgrade - skipping PSConfig commonly leaves the farm partially patched. Where immediate patching is not possible, reduce exposure by restricting network access to the SharePoint web application (limit to VPN/internal ranges and remove internet exposure), tightening site membership so untrusted or low-trust accounts cannot submit content, and monitoring for anomalous deserialization/ViewState errors and unexpected process spawning from the SharePoint application pool identity; these controls reduce the pool of potential authenticated attackers but do not eliminate the flaw and may disrupt legitimate external collaboration.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today