EUVD-2026-43779
GHSA-q6cq-5qpf-q237
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization yields RCE with no user interaction, giving AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H impact within the server's scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) allows an unauthenticated network attacker to run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). The CVSS 3.1 base score is 9.8 with a fully remote, no-interaction, no-privilege vector (AV:N/AC:L/PR:N/UI:N), placing it among the most severe SharePoint flaws. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but insecure-deserialization RCE in SharePoint has historically been a high-value target for rapid weaponization.
Technical ContextAI
SharePoint is Microsoft's on-premises web-based collaboration and document-management platform built on ASP.NET and the .NET Framework, where server-side controls and web endpoints routinely accept serialized object payloads. This vulnerability is a CWE-502 Deserialization of Untrusted Data flaw: the application deserializes attacker-supplied data into .NET objects without sufficient type validation, allowing an attacker to smuggle a malicious object graph (a 'gadget chain') that executes code during or after deserialization. The affected CPEs confirm the on-premises server SKUs - cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, microsoft_sharepoint_server_2019, and microsoft_sharepoint_server_subscription_edition - meaning this impacts customer-managed farms rather than SharePoint Online. Root cause classes like this typically stem from ViewState, BinaryFormatter/DataSet, or SOAP/XML deserialization paths reachable through a web endpoint.
RemediationAI
Apply the vendor-released Microsoft security update for your SharePoint edition as the primary fix; the exact patched build should be taken from the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644 (patch confirmed available per vendor, exact fix version not enumerated in the provided data). Because this is unauthenticated network RCE, prioritize patching internet-facing farms first and update all servers in the farm to keep builds consistent. Where immediate patching is not possible, compensating controls include restricting network access to SharePoint web endpoints to trusted networks/VPN and placing the farm behind a WAF tuned to inspect and block suspicious serialized/ViewState payloads (trade-off: WAF signatures may be bypassed by novel gadget chains and can break legitimate large POST requests), ensuring AMSI integration and up-to-date antimalware are enabled for SharePoint (trade-off: adds request-processing overhead), and enforcing least-privilege service accounts to limit post-exploitation blast radius. After patching, hunt for prior compromise since deserialization RCE can be exploited pre-patch without leaving obvious application errors.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today