What is the CVSS score of CVE-2026-64901?

CVE-2026-64901 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.6%.

Which versions of Microsoft SharePoint are affected by CVE-2026-64901?

Microsoft SharePoint Server (CVE-2026-64901) contains a remote code execution vulnerability affecting all three major enterprise versions-2016, 2019, and Subscription Edition-that allows any…. A patch is available.

How to fix or mitigate CVE-2026-64901?

Within 24 hours, conduct an inventory of all SharePoint Server deployments across the organization (2016, 2019, and Subscription Edition instances), identify systems hosting business-critical content, and test the vendor-released patch in a pre-production environment to validate compatibility with custom solutions. Within 7 days, prioritize patching of production SharePoint instances based on data criticality, beginning with systems hosting sensitive IP, financial data, or customer information; conduct phased deployments during maintenance windows to minimize disruption. By 30 days, ensure all affected SharePoint Server instances have been patched to the vendor-specified remediated build level, perform post-patch security verification scans, and implement monitoring alerts for suspicious serialized object payload submissions and unauthorized code execution attempts.

Microsoft SharePoint CVE-2026-64901

EUVD-2026-56706 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-11 secure@microsoft.com

GHSA-8r25-8pqr-9xg6

Deserialization Microsoft Sharepoint Server

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered deserialization exploit requires only a valid SharePoint account (PR:L); no special conditions (AC:L); arbitrary code execution yields full C/I/A impact with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:45 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft SharePoint Server allows any authenticated network attacker to execute arbitrary code by submitting a malicious serialized object payload to vulnerable endpoints. Three major SharePoint versions are affected - SharePoint Server 2016, 2019, and Subscription Edition - all running build versions below their respective patched thresholds. No public exploit code has been identified at time of analysis, but the low privilege requirement (any valid SharePoint account) and low attack complexity make this a high organizational priority, particularly given SharePoint's widespread enterprise deployment footprint.

Technical ContextAI

The root cause is CWE-502 (Deserialization of Untrusted Data), a well-understood class of vulnerabilities in which serialized objects from attacker-controlled input are deserialized by the server without adequate type validation or integrity checks, enabling gadget-chain exploitation to achieve arbitrary code execution. Microsoft SharePoint is built on the .NET platform, which has a documented history of deserialization gadget chains (e.g., via BinaryFormatter or similar mechanisms). The affected products - SharePoint Server 2016 (16.0.x), SharePoint Server 2019 (16.0.x), and SharePoint Server Subscription Edition (16.0.x) - all share the same major version line (16.0.0), suggesting the vulnerable deserialization pathway exists in a shared code component across these releases. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the flaw is reachable over the network, requires no complex preconditions, and yields full impact across confidentiality, integrity, and availability.

RemediationAI

Apply Microsoft's cumulative updates immediately: upgrade SharePoint Server 2019 to build 16.0.10417.20198 or later, SharePoint Server Subscription Edition to build 16.0.19725.20522 or later, and SharePoint Enterprise Server 2016 to build 16.0.5565.1001 or later. Patch downloads and installation guidance are available through the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64901. As a compensating control prior to patching, consider restricting external network access to SharePoint endpoints (e.g., blocking inbound HTTPS from untrusted networks at the perimeter or WAF layer) - this reduces the attack surface but will impact legitimate remote access and may not protect against insider threats or attackers already on the corporate network. Additionally, auditing and restricting the pool of users with SharePoint accounts (removing unnecessary accounts) reduces the effective attacker population, though it does not eliminate the vulnerability. No specific SharePoint feature has been identified in available data as the sole trigger for the deserialization pathway, so feature-level disablement cannot be recommended without further vendor guidance.