EUVD-2026-56297
GHSA-jg9v-rf24-xph9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable and low complexity; PR:L reflects required authentication; I:L added because identity spoofing plausibly enables unauthorized writes or impersonation-driven modifications.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Deserialization of untrusted data in Microsoft SharePoint Server exposes networks to spoofing attacks by authenticated low-privileged users. Confirmed affected versions span SharePoint Enterprise Server 2016, SharePoint Server 2019, and the Subscription Edition. The CVSS vector (PR:L, C:H, I:N) indicates an authenticated attacker can leverage unsafe deserialization to impersonate another identity or access confidential data, though no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
CWE-502 (Deserialization of Untrusted Data) describes a root cause where an application deserializes attacker-controlled input without sufficient validation or type-safety enforcement. In SharePoint Server - a .NET-based collaboration platform - deserialization gadget chains can be abused to influence server-side object state. The CPE data confirms three distinct product lines are affected: cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:* (Subscription Edition), cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:* (Enterprise 2016), and cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* (2019). All share the same version-16.0 codebase, meaning the deserialization path is likely present across the shared code base. The spoofing impact (rather than RCE) may indicate partial gadget chain exploitation or that the deserialization flaw is constrained to identity/session-context manipulation rather than arbitrary code execution.
RemediationAI
Vendor-released patches are available for all three affected product lines. Administrators should update Microsoft SharePoint Enterprise Server 2016 to version 16.0.5565.1001 or later, Microsoft SharePoint Server 2019 to version 16.0.10417.20198 or later, and Microsoft SharePoint Server Subscription Edition to version 16.0.19725.20522 or later, as documented in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63516. Organizations unable to patch immediately should consider restricting network access to SharePoint services to trusted internal segments or VPN endpoints, limiting the pool of users who can reach the vulnerable deserialization endpoint. Enforcing multi-factor authentication reduces risk by raising the cost of credential compromise needed for exploitation. Monitor SharePoint ULS logs for anomalous deserialization-related exceptions or unexpected identity transitions, which may indicate exploitation attempts.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Code injection (CWE-94) in Microsoft SharePoint Server exposes authenticated network users to high-impact compromise acr
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today