EUVD-2026-56430
GHSA-5xx3-f8cq-vgc3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable deserialization RCE requiring only a low-privilege authenticated account; full C/I/A impact from arbitrary code execution in the SharePoint process; scope unchanged as exploit targets the local SharePoint server.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft SharePoint allows any authenticated, low-privileged network attacker to execute arbitrary code on the server by exploiting unsafe deserialization of attacker-controlled data (CWE-502). Three on-premises SharePoint Server product lines are confirmed affected - Enterprise Server 2016, Server 2019, and Server Subscription Edition - with fixed builds available from Microsoft. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session with at minimum low-privilege access to the target SharePoint deployment, consistent with the PR:L CVSS metric and the CVE description's reference to an 'authorized attacker.' No special non-default configuration, specific SharePoint feature enablement, or elevated role is described as required - the vulnerable deserialization path appears reachable by any authenticated user. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score is well-calibrated for this vulnerability: network-accessible (AV:N), low complexity (AC:L), requires only a low-privilege authenticated session (PR:L), no user interaction (UI:N), and yields full confidentiality, integrity, and availability impact consistent with server-side RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a standard low-privilege SharePoint account - such as a domain user with site member or contributor access on any site collection - crafts a malicious serialized .NET object and submits it to a vulnerable SharePoint web service endpoint over HTTP/HTTPS. The server deserializes the payload without type validation, executing attacker-controlled code in the context of the SharePoint IIS application pool (typically running as a service account with significant local and domain privileges). … |
| Remediation | The primary remediation is to apply Microsoft's released patches: upgrade SharePoint Enterprise Server 2016 to build 16.0.5565.1001 or later, SharePoint Server 2019 to build 16.0.10417.20198 or later, and SharePoint Server Subscription Edition to build 16.0.19725.20522 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all on-premises SharePoint Server 2016, 2019, and Subscription Edition deployments and confirm patch availability from Microsoft for each affected version. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today