What is the CVSS score of EUVD-2026-56573?

EUVD-2026-56573 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.3%.

Which versions of Microsoft SharePoint are affected by EUVD-2026-56573?

Microsoft Office SharePoint contains a remote code execution vulnerability (CVSS 8.8) enabling authenticated users with low-level access to execute arbitrary code and compromise system…. A patch is available.

How to fix or mitigate EUVD-2026-56573?

Within 24 hours: inventory all SharePoint deployments, identify business-critical instances, and document current user access privileges. Within 7 days: restrict SharePoint access to users with documented business need, enforce network segmentation to limit lateral movement from compromised accounts, and enable detailed audit logging on deserialization events and administrative actions. Within 30 days: establish a vendor patch monitoring process with Microsoft and apply security updates immediately upon release; evaluate architectural alternatives or temporary air-gapping for highest-risk instances if extended patch delay occurs.

Microsoft SharePoint EUVD-2026-56573

| CVE-2026-70321 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-11 secure@microsoft.com

GHSA-h6gw-pxjf-hvrf

Deserialization Microsoft Sharepoint Server

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable deserialization endpoint requires low-privilege authentication; full code execution yields high C/I/A with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 17:53 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Office SharePoint allows an attacker authenticated with low privileges to execute arbitrary code over a network via unsafe deserialization of user-controlled data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms full confidentiality, integrity, and availability impact with no user interaction required. No public exploit code has been identified at time of analysis, and SharePoint is not currently listed in the CISA KEV catalog based on available data.

Technical ContextAI

CWE-502 (Deserialization of Untrusted Data) is the root cause class - the application deserializes attacker-controlled data without sufficient validation, allowing the attacker to craft a malicious serialized object that, when processed by the server, triggers arbitrary code execution. Microsoft SharePoint is an enterprise collaboration and document management platform built on .NET, which uses binary or XML serialization formats (e.g., BinaryFormatter, DataContractSerializer) in various subsystems. Insecure deserialization in .NET applications is a well-established attack class with known gadget chains. No CPE string was provided in the input data, so exact affected product versions cannot be specified from CPE alone; the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70321 should be consulted for precise version information.

RemediationAI

Apply the security update issued by Microsoft for this vulnerability, referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70321. An exact patched version number was not confirmed in the available intelligence data; consult the MSRC advisory directly to identify the correct Cumulative Update for your SharePoint version and farm configuration. As an interim compensating control, restrict network access to SharePoint administrative and API endpoints to trusted IP ranges, reducing the attacker's ability to submit crafted serialized payloads. Enforcing multi-factor authentication on all SharePoint accounts raises the effective privilege bar above 'low' in practice, mitigating risk without eliminating it. Review SharePoint service account privileges and ensure they run with least-privilege permissions to limit post-exploitation blast radius.