What is the CVSS score of CVE-2026-66808?

CVE-2026-66808 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.6%.

Which versions of Microsoft SharePoint are affected by CVE-2026-66808?

Microsoft Office SharePoint is affected by a remote code execution vulnerability (CVE-2026-66808) with CVSS 8.8 severity that could result in complete compromise of affected systems' confidentiality,…. A patch is available.

How to fix or mitigate CVE-2026-66808?

Within 24 hours, audit your Microsoft Office SharePoint infrastructure to identify affected systems and assess exposure to less-trusted network segments or external access; document systems containing sensitive data for prioritization. Within 7 days, implement network segmentation to restrict SharePoint access to essential personnel only, enforce strict access and authorization controls, and significantly increase monitoring for suspicious deserialization events and unusual account activity. Within 30 days, continue monitoring Microsoft's official advisories and security updates for patch availability, and plan immediate deployment procedures upon patch release while maintaining compensating controls.

Microsoft SharePoint CVE-2026-66808

EUVD-2026-56750 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-11 secure@microsoft.com

GHSA-3hq7-6h7j-3wxc

Deserialization Microsoft Red Hat Sharepoint Server

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-exploitable deserialization requiring only low-privilege authenticated access; no user interaction; full confidentiality, integrity, and availability impact on the vulnerable system.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.7 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 18:11 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Office SharePoint exploits unsafe deserialization of attacker-controlled data over the network. An authenticated attacker with low-level network access can submit a crafted serialized payload that SharePoint deserializes without sufficient validation, resulting in full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, but the low attack complexity and high impact across all three security properties make this a critical remediation priority.

Technical ContextAI

CWE-502 (Deserialization of Untrusted Data) describes a root cause where an application deserializes data from an untrusted source without first validating or sanitizing it. In .NET-based platforms such as Microsoft SharePoint, deserialization gadget chains can be leveraged to achieve arbitrary code execution by crafting malicious serialized objects that trigger dangerous method calls during the deserialization process. The affected product is Microsoft Office SharePoint, a widely deployed enterprise collaboration and document management platform. The CVSS vector AV:N/AC:L/PR:L/UI:N indicates the vulnerability is exploitable remotely with low complexity and requires only low-privilege authenticated access, consistent with a SharePoint user-level account being sufficient to submit the malicious payload.

RemediationAI

The primary remediation is to apply the vendor-released patch via Microsoft's Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66808. Exact patch version numbers should be retrieved directly from the MSRC advisory, as no specific fix version was included in the source intelligence provided - 'patch available per vendor advisory' is the most accurate characterization at this time. As a compensating control prior to patching, organizations should restrict SharePoint access to only explicitly authorized user accounts, reducing the pool of principals capable of delivering a malicious payload. Additionally, network-layer controls that limit which hosts can submit data to SharePoint endpoints may reduce exposure. These controls do not eliminate the vulnerability but raise the bar for exploitation. Monitoring SharePoint server logs for anomalous deserialization activity or unexpected process spawning may aid in detection.