Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T17:18:50.937Z",
  "pubdate": "2026-08-11T17:18:50.937Z",
  "executiveSummary": "A deserialization of untrusted data vulnerability exists in Microsoft Office SharePoint, exposing enterprise environments to severe security risks.\nThe vulnerability class is insecure deserialization, which allows an authenticated attacker to achieve remote code execution across a network.\nImpacted systems include Microsoft Office SharePoint Server deployments that improperly handle serialized objects supplied by users.\nThe primary risk implication is a complete compromise of the underlying server infrastructure, potentially leading to unauthorized data access, lateral movement, and persistent control over the host system.\nAttacker capabilities require network access to the target SharePoint instance and valid credentials to interact with vulnerable endpoints.\nSuccessful exploitation requires the attacker to possess authorization within the SharePoint environment, after which they can craft malicious payloads designed to abuse the insecure deserialization mechanism.",
  "technicalDetails": "The root cause of the vulnerability stems from the insecure handling and deserialization of untrusted data streams within Microsoft Office SharePoint components.\nWhen SharePoint processes serialized objects without proper type validation, integrity checks, or secure filtering mechanisms, an attacker can manipulate the input data to instantiate arbitrary types or invoke unintended methods during the deserialization lifecycle.\nThe affected component involves SharePoint routines responsible for parsing and reconstructing object graphs from serialized payloads transmitted over network protocols.\nExploitation occurs via a network vector, requiring the attacker to interact with vulnerable SharePoint services.\nAuthentication requirements dictate that the attacker must be an authorized user within the system, possessing the necessary privileges to submit payloads to the vulnerable endpoints.\nThe attack flow initiates when the attacker crafts a specialized serialized payload containing malicious gadget chains or objects designed to execute arbitrary code upon instantiation.\nThe attacker transmits this payload across the network to the vulnerable SharePoint server.\nUpon receipt, the SharePoint application attempts to deserialize the untrusted data stream without adequate validation.\nDuring the deserialization process, the crafted payload triggers unintended execution pathways, leading to the instantiation of dangerous classes and the execution of arbitrary system commands under the security context of the SharePoint application pool or service account.\nPost-exploitation impact includes full remote code execution, granting the attacker the ability to read, modify, or delete sensitive SharePoint data, install backdoors, pivot to other internal network segments, or escalate privileges within the domain."
}