EUVD-2026-33745
GHSA-chp7-cgwg-984j
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft SharePoint Server (2016 Enterprise, 2019, and Subscription Edition) allows an authenticated attacker to execute arbitrary code on the server by submitting crafted serialized data that triggers unsafe deserialization. The CVSS 8.0 vector requires low privileges and user interaction, and no public exploit is identified at time of analysis. The flaw is significant because SharePoint servers typically run with high privileges inside enterprise environments and frequently host sensitive collaboration data.
Technical ContextAI
SharePoint exposes various endpoints that process serialized .NET objects (BinaryFormatter, DataContractSerializer, or similar) for features such as workflows, web parts, and inter-service communication. The CWE-78 classification (OS Command Injection) combined with the Deserialization tag indicates that an attacker-controlled serialized payload is reconstructed into a gadget chain that ultimately reaches a command execution sink, allowing arbitrary OS commands to run in the context of the SharePoint application pool identity. Affected CPEs explicitly cover SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, indicating the flawed code path is present across all currently supported on-premises SharePoint product lines.
RemediationAI
Apply the vendor-released security update available through Microsoft's monthly Patch Tuesday channel as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47294, selecting the package matching your SharePoint SKU (2016 Enterprise, 2019, or Subscription Edition); exact KB numbers and fix builds should be retrieved directly from MSRC since they were not enumerated in the provided intelligence. As compensating controls until patching completes, restrict network access to SharePoint web front-ends so only authenticated corporate users can reach them (blocks remote opportunistic attackers but does not stop insider abuse), enable AMSI integration for SharePoint if running 2016/2019/SE so .NET deserialization payloads are scanned by Defender (small CPU overhead per request), and review least-privilege on the application pool identity to limit the blast radius of any RCE (may break custom solutions that assume elevated rights). Auditing for unusual w3wp.exe child processes and outbound connections from SharePoint servers provides detection coverage during the patch window.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today