Microsoft SharePoint EUVD-2026-99723

Exploitation requires the attacker to be an authenticated, authorized user of the SharePoint deployment (CVSS PR:L) - the attacker must possess at least low-privilege access to a SharePoint site/endpoint before sending the malicious serialized payload. No user interaction is needed (UI:N) and the vector is fully network-reachable (AV:N) with low attack complexity (AC:L). Affected scope is limited to Microsoft SharePoint Server Subscription Edition builds below 16.0.20326.20190; environments already patched to 16.0.20326.20190 or later are not exploitable. The primary limiting factor is the authentication requirement: this is not an unauthenticated internet-wide drive-by, so risk is highest where low-privilege accounts are easily obtained (self-service/guest access, broad internal user bases, or credential compromise).

This is a credible, actionable priority rather than an inflated high-CVSS score. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity exploitation with no user interaction and full confidentiality/integrity/availability impact, requiring only low privileges (PR:L) - consistent with the description's 'authorized attacker.' CWE-502 deserialization flaws in SharePoint have a strong historical track record of being weaponized into reliable unauthenticated-adjacent RCE chains, and SharePoint is a high-value enterprise target, so the combination of low attacker effort and high impact is concerning. However, several key signals are MISSING from the input and must be acknowledged: no EPSS score was provided, so exploitation probability cannot be quantified; there is no CISA KEV listing (no confirmed active exploitation); and no POC/exploit-code availability is indicated. The only non-NVD reference is the Microsoft MSRC advisory itself. Net assessment: treat as a high-priority patch given the CWE class, product value, and low-privilege RCE profile, but note that real-world exploitation prevalence is currently unverified - the urgency is driven by impact and vulnerability class, not by any confirmed exploitation signal.

An attacker who already holds low-privileged authenticated access to a SharePoint site (e.g., a standard user account or compromised credentials) sends a crafted request containing a malicious serialized object to a vulnerable SharePoint endpoint. Unsafe deserialization (CWE-502) of that payload triggers remote code execution in the SharePoint server context over the network. No public exploit identified at time of analysis, and no user interaction is required.