What is the CVSS score of CVE-2026-66805?

CVE-2026-66805 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.6%.

Which versions of Microsoft SharePoint are affected by CVE-2026-66805?

Microsoft Office SharePoint contains a critical remote code execution vulnerability (CVE-2026-66805, CVSS 8.8) that allows any authenticated user with standard low-privilege SharePoint access to…. A patch is available.

How to fix or mitigate CVE-2026-66805?

Within 24 hours: Conduct complete inventory of all SharePoint deployments and low-privilege user accounts with network access; implement firewall rules restricting SharePoint access to essential users only; enable detailed logging of authentication and deserialization events. Within 7 days: Establish baseline SharePoint activity and configure alerts for anomalous deserialization, code execution, and privilege escalation; audit and revoke unnecessary low-privilege accounts; contact Microsoft support to confirm patch availability timeline; implement Web Application Firewall (WAF) rules to block malformed serialization payloads. Within 30 days: Continuously monitor Microsoft security advisories for patch release; prepare and test emergency patch deployment procedures; conduct security assessment of other serialization-based vulnerabilities in your environment; validate offline backup and recovery procedures; integrate all compensating controls into incident response procedures.

Microsoft SharePoint CVE-2026-66805

EUVD-2026-56747 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-11 secure@microsoft.com

GHSA-w35v-hpfj-gw86

Deserialization Microsoft Red Hat Sharepoint Server

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network vector and low complexity confirmed by deserialization over HTTP; PR:L reflects required authenticated account; full CIA impact from arbitrary code execution on server.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.0 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 18:12 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Office SharePoint enables any authenticated low-privileged user to execute arbitrary code on the server by submitting maliciously crafted serialized data over the network. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires no user interaction, low complexity, and only a standard SharePoint account - making this straightforward to weaponize within any organization whose SharePoint is network-accessible to internal users or external authenticated parties. No public exploit code or CISA KEV listing is identified at time of analysis, though SharePoint deserialization vulnerabilities have historically attracted rapid weaponization.

Technical ContextAI

Microsoft SharePoint is an enterprise collaboration and document management platform widely used for intranet portals, workflow automation, and content management. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data), a root cause class in which application logic deserializes attacker-controlled byte streams without sufficient type validation or integrity checks, allowing the attacker to supply a gadget chain that executes arbitrary methods during the deserialization process. SharePoint's server-side processing of user-supplied data - likely through document handling, list operations, or API endpoints - accepts serialized input and reconstructs objects without adequately constraining the object graph, enabling code execution in the context of the SharePoint application pool or IIS worker process. The MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66805) is the authoritative source for affected component details.

RemediationAI

Apply the Microsoft security update addressing CVE-2026-66805 as released through the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66805. The exact patched version is not independently confirmed from the available data - consult the MSRC advisory for the specific KB article and patch version applicable to your SharePoint Server edition or confirm Microsoft 365 SharePoint Online is updated via tenant status. If immediate patching is not feasible, consider restricting SharePoint access to known IP ranges or VPN-only endpoints to reduce the low-privilege network attack surface, accepting the trade-off of reduced remote worker accessibility. Disabling or rate-limiting specific deserialization-dependent features (such as BCS external data connections or custom web parts processing serialized content) may reduce exposure but requires environment-specific assessment. Enforce multi-factor authentication on all SharePoint accounts to raise the cost of credential-based exploitation.