EUVD-2026-35581
GHSA-v99j-98xx-cvgv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft Office SharePoint allows an authenticated network attacker to elevate privileges by submitting maliciously crafted serialized data that the server deserializes without proper validation. The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability combined with low attack complexity, though the PR:L requirement means the attacker must already hold at least a low-privileged SharePoint account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold valid authenticated credentials to the target SharePoint instance (CVSS PR:L) and must have network reachability to a SharePoint web front-end endpoint that accepts and deserializes user-supplied data - in most deployments that means any account with at least Contribute or Read on any site collection plus HTTPS access to the farm. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) signals a realistically exploitable, high-impact network attack with one notable gating factor: PR:L means the attacker needs a valid low-privileged SharePoint identity, which in many enterprises is broadly held by any authenticated employee. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or phished a standard SharePoint user credential authenticates to an internet-facing SharePoint site and submits an HTTP request to a vulnerable endpoint with a crafted serialized .NET object that triggers a gadget chain during deserialization. Execution occurs in the SharePoint application pool context, giving the attacker the privileges of the SharePoint farm service account - typically enough to read all site content, plant a webshell, harvest the machine key, and move laterally to other farm servers. … |
| Remediation | Patch availability per vendor advisory should be confirmed via the MSRC entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45484, which will list the corresponding security update KB articles per SharePoint edition; exact fix build numbers were not provided in the input data and must be retrieved from that advisory before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Identify and document all SharePoint instances and users with low-privileged accounts; enable detailed audit logging for deserialization events and privilege escalation attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today