EUVD-2026-56433
GHSA-j9wh-7m6g-7824
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible endpoint requires low-privilege account (PR:L); deserialization is straightforward once authenticated (AC:L); full server compromise yields high C/I/A with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft SharePoint Server allows a network-authenticated attacker with low-level privileges to execute arbitrary code by exploiting unsafe deserialization of attacker-controlled data. Both SharePoint Server 2019 and the Subscription Edition are confirmed affected, with patches available from Microsoft. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and full-triad impact (C:H/I:H/A:H) make this a high-priority patching target for enterprise environments.
Technical ContextAI
CWE-502 (Deserialization of Untrusted Data) describes a class of vulnerability where an application deserializes data without validating or sanitizing it, allowing an attacker to craft a malicious serialized payload that triggers arbitrary code execution during the deserialization process. Microsoft SharePoint is a .NET-based collaborative platform that uses .NET serialization mechanisms internally for various data processing operations. When deserialization of attacker-supplied input is performed without type-checking, allowlisting, or cryptographic verification of the payload, an attacker can substitute a malicious object graph that exploits .NET gadget chains to achieve remote code execution on the server. Affected products per EUVD data: Microsoft SharePoint Server Subscription Edition (versions up to 16.0.19725.20522) and Microsoft SharePoint Server 2019 (versions up to 16.0.10417.20198).
RemediationAI
Apply the vendor-released patches immediately: upgrade SharePoint Server Subscription Edition to build 16.0.19725.20522 or later, and SharePoint Server 2019 to build 16.0.10417.20198 or later. Patch details and download links are available through the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65665. As a compensating control where immediate patching is not feasible, restrict network access to SharePoint web application endpoints at the perimeter or WAF layer to prevent unauthenticated network reachability, noting this does not eliminate risk from already-authenticated insider or compromised-credential scenarios. Additionally, audit and minimize the number of accounts with any SharePoint access, as PR:L means any valid account is sufficient for exploitation. Enable detailed SharePoint ULS and Windows Event logging to detect unusual server-side execution patterns. Note that none of these workarounds substitute for patching, and each introduces operational trade-offs (reduced accessibility, log volume overhead).
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Code injection (CWE-94) in Microsoft SharePoint Server exposes authenticated network users to high-impact compromise acr
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today