What is the CVSS score of CVE-2026-45484?

CVE-2026-45484 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Microsoft SharePoint are affected by CVE-2026-45484?

A privilege escalation vulnerability in Microsoft Office SharePoint (CVE-2026-45484, CVSS 8.8) allows authenticated users with low-privileged accounts to escalate their access to higher privilege…. A patch is available.

How to fix or mitigate CVE-2026-45484?

24 hours: Identify and document all SharePoint instances and users with low-privileged accounts; enable detailed audit logging for deserialization events and privilege escalation attempts. 7 days: Restrict SharePoint access to only essential personnel where operationally feasible; audit low-privileged accounts and disable unnecessary access. 30 days: Monitor Microsoft security advisories for patch availability (CVE-2026-45484); apply patch immediately upon release; conduct post-patch security review of SharePoint privilege changes.

Microsoft SharePoint CVE-2026-45484

EUVD-2026-35581 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-09 secure@microsoft.com

GHSA-v99j-98xx-cvgv

Microsoft Deserialization Sharepoint Server

8.8

CVSS 3.1 · Vendor: microsoft

Temporal: 7.7

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

7.7 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:20 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Office SharePoint allows an authenticated network attacker to elevate privileges by submitting maliciously crafted serialized data that the server deserializes without proper validation. The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability combined with low attack complexity, though the PR:L requirement means the attacker must already hold at least a low-privileged SharePoint account. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

The flaw falls under CWE-502 (Deserialization of Untrusted Data), a well-known class of bugs in .NET applications where formatters such as BinaryFormatter, LosFormatter, NetDataContractSerializer, or SoapFormatter reconstitute objects from attacker-controlled byte streams. SharePoint Server runs on the .NET/ASP.NET stack and has historically been a fertile target for deserialization gadgets (e.g., the ViewState and DataSet families used in CVE-2019-0604, CVE-2020-1147, and the ToolShell chain). When a SharePoint endpoint accepts serialized payloads from an authenticated user without enforcing type filtering or a Type Validator, an attacker can supply a gadget chain that triggers arbitrary code execution within the SharePoint worker process (typically running as the configured application pool identity), which is how a 'privilege escalation' manifests despite the CWE-502 root cause.

RemediationAI

Patch availability per vendor advisory should be confirmed via the MSRC entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45484, which will list the corresponding security update KB articles per SharePoint edition; exact fix build numbers were not provided in the input data and must be retrieved from that advisory before deployment. Until the update can be applied, compensating controls include restricting access to the SharePoint web front ends to trusted networks via firewall or reverse-proxy ACLs (trade-off: blocks legitimate remote workers unless on VPN), removing low-privileged accounts from broad SharePoint membership groups to shrink the PR:L exploitation surface (trade-off: may break collaboration workflows), enabling AMSI integration and ensuring SharePoint's AMSI provider is set to 'Enabled and Block' if running a supported edition (trade-off: minor request-handling overhead and possible false positives), and monitoring IIS and ULS logs for anomalous POST bodies to SharePoint endpoints, particularly those carrying base64 or XML payloads indicative of .NET gadget chains.