EUVD-2026-33745
GHSA-chp7-cgwg-984j
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft SharePoint Server (2016 Enterprise, 2019, and Subscription Edition) allows an authenticated attacker to execute arbitrary code on the server by submitting crafted serialized data that triggers unsafe deserialization. The CVSS 8.0 vector requires low privileges and user interaction, and no public exploit is identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must hold a valid low-privileged SharePoint account (PR:L) on a vulnerable on-premises SharePoint Server 2016 Enterprise, 2019, or Subscription Edition deployment reachable over the network (AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R) describes a network-reachable flaw with low complexity but requires both low-level authentication and user interaction, which materially reduces drive-by exploitation risk compared to a pre-auth RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained any low-privileged SharePoint account (for example via phishing or password spray) crafts a malicious serialized .NET payload and submits it to a vulnerable SharePoint endpoint, then induces a legitimate user to click a link or open a page that triggers processing of the payload. Deserialization invokes a gadget chain that executes attacker-chosen OS commands as the SharePoint service account, giving the attacker a foothold to harvest credentials, pivot to the SQL backend, or exfiltrate document libraries. … |
| Remediation | Apply the vendor-released security update available through Microsoft's monthly Patch Tuesday channel as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47294, selecting the package matching your SharePoint SKU (2016 Enterprise, 2019, or Subscription Edition); exact KB numbers and fix builds should be retrieved directly from MSRC since they were not enumerated in the provided intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all deployed SharePoint Server instances (versions 2016, 2019, Subscription Edition) and document user access scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today