EUVD-2026-56428
GHSA-cqmq-63vg-9mc5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-delivered deserialization requiring only a valid user account (PR:L); no user interaction; full system impact with scope unchanged to SharePoint host.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft SharePoint Server exposes organizations to full system compromise via deserialization of attacker-controlled data submitted over the network. Versions across three SharePoint Server editions (Subscription Edition, 2019, and Enterprise 2016) are confirmed affected, all requiring only a low-privileged authenticated account to exploit. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and high impact across confidentiality, integrity, and availability make this a critical-priority remediation item for any enterprise SharePoint deployment.
Technical ContextAI
The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data), a class of flaw where application code reconstitutes serialized object graphs from network-supplied input without validating or sanitizing the deserialized content. Microsoft SharePoint, built on ASP.NET and the Microsoft .NET runtime, processes serialized objects as part of its collaboration and content management workflows. When an attacker supplies a crafted serialized payload - exploiting gadget chains present in the .NET class library or SharePoint-specific assemblies - the deserialization process can invoke arbitrary methods, ultimately executing code in the context of the SharePoint server process. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms this is exploitable remotely with low complexity and no user interaction once authentication is established. Affected product lines per EUVD-2026-56428: SharePoint Server Subscription Edition below 16.0.19725.20522, SharePoint Server 2019 below 16.0.10417.20198, and SharePoint Enterprise Server 2016 below 16.0.5565.1001.
RemediationAI
The primary remediation is to apply Microsoft's released security update immediately. Target versions are: SharePoint Server Subscription Edition 16.0.19725.20522 or later, SharePoint Server 2019 16.0.10417.20198 or later, and SharePoint Enterprise Server 2016 16.0.5565.1001 or later. Updates and full patch guidance are available through the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65658. As a temporary compensating control prior to patching, restrict network access to SharePoint services to known, trusted IP ranges or enforce VPN-only access - note this may interrupt legitimate remote collaboration workflows and does not eliminate the vulnerability. Enforcing multi-factor authentication on all SharePoint accounts raises the effective barrier against credential-based entry but does not block exploitation once an attacker authenticates. Monitoring SharePoint application logs for anomalous deserialization-related exceptions or unusual process spawning from the SharePoint service account can support early detection.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Code injection (CWE-94) in Microsoft SharePoint Server exposes authenticated network users to high-impact compromise acr
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today