EUVD-2026-56430
GHSA-5xx3-f8cq-vgc3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable deserialization RCE requiring only a low-privilege authenticated account; full C/I/A impact from arbitrary code execution in the SharePoint process; scope unchanged as exploit targets the local SharePoint server.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft SharePoint allows any authenticated, low-privileged network attacker to execute arbitrary code on the server by exploiting unsafe deserialization of attacker-controlled data (CWE-502). Three on-premises SharePoint Server product lines are confirmed affected - Enterprise Server 2016, Server 2019, and Server Subscription Edition - with fixed builds available from Microsoft. No public exploit code has been identified at time of analysis, but the low attack complexity and precedent of prior SharePoint deserialization CVEs being rapidly weaponized (e.g., CVE-2019-0604) make this a high-priority patching target for any organization running on-premises SharePoint.
Technical ContextAI
CWE-502 (Deserialization of Untrusted Data) is the root cause: SharePoint deserializes attacker-controlled objects server-side without sufficient type validation or integrity checks, enabling classic object injection leading to arbitrary code execution. Microsoft SharePoint Server is an ASP.NET-based enterprise collaboration platform that routinely processes serialized .NET objects across its web services and application tiers. The .NET BinaryFormatter and related serialization APIs have a long history of enabling RCE when fed untrusted input, and SharePoint's extensive internal use of serialized state makes it a recurrent target for this class of flaw. Affected product lines confirmed via ENISA EUVD-2026-56430 are: SharePoint Enterprise Server 2016 (versions below 16.0.5565.1001), SharePoint Server 2019 (versions below 16.0.10417.20198), and SharePoint Server Subscription Edition (versions below 16.0.19725.20522). The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the deserialization endpoint is directly reachable over the network with no non-default configuration required.
RemediationAI
The primary remediation is to apply Microsoft's released patches: upgrade SharePoint Enterprise Server 2016 to build 16.0.5565.1001 or later, SharePoint Server 2019 to build 16.0.10417.20198 or later, and SharePoint Server Subscription Edition to build 16.0.19725.20522 or later. Patch details and download links are available through the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65663. Where immediate patching is not possible, specific compensating controls include: restricting external network access to SharePoint farm servers at the perimeter firewall or WAF to limit exploitation to internal authenticated users only (trade-off: does not mitigate insider threat or compromised internal credentials); auditing and minimizing the number of accounts holding any SharePoint site access to reduce the exploitable authenticated population; and enabling enhanced logging of SharePoint ULS logs and Windows event logs for anomalous w3wp.exe child process spawning, which may indicate post-exploitation activity. These mitigations do not remediate the root vulnerability and should be treated as temporary measures only until patching is complete.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Code injection (CWE-94) in Microsoft SharePoint Server exposes authenticated network users to high-impact compromise acr
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today