Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T17:18:54.510Z",
  "pubdate": "2026-08-11T17:18:54.510Z",
  "executiveSummary": "A deserialization of untrusted data vulnerability exists within Microsoft Office SharePoint. This security flaw allows an authenticated attacker to achieve remote code execution across a network. The vulnerability impacts Microsoft Office SharePoint installations, presenting significant risk implications to enterprise environments by potentially compromising the confidentiality, integrity, and availability of the underlying server infrastructure. Exploitation of this flaw requires the attacker to possess authorized access to the SharePoint environment, lowering the barrier for internal threat actors or compromised accounts. Successful exploitation grants the adversary the capability to execute arbitrary code within the context of the SharePoint application, leading to full system compromise or lateral movement within the network. Mitigation requires applying official vendor patches and adhering to strict access control policies to minimize unauthorized interactions with vulnerable serialization endpoints.",
  "technicalDetails": "The vulnerability stems from the insecure handling and deserialization of untrusted data streams within Microsoft Office SharePoint components. Specifically, the application processes serialized objects without proper validation, type checking, or integrity verification before instantiating them in memory. The root cause lies in the architectural reliance on vulnerable serialization format handlers that trust incoming payloads provided by the caller.\nExploitation of this vulnerability requires the attacker to have network connectivity to the SharePoint service and valid authentication credentials. Although authentication is required, an authorized attacker can craft a malicious serialized payload designed to leverage vulnerable gadgets present in the application classpath or dependency libraries. The attack flow initiates when the adversary transmits the crafted serialized object over the network to a vulnerable endpoint within Microsoft Office SharePoint that handles object reconstruction.\nUpon receipt, the SharePoint application attempts to deserialize the input stream. During the instantiation process, the malicious payload manipulates control flow by invoking unintended methods, often referred to as gadget chains. These gadget chains trigger secondary actions, such as executing system commands or loading dynamic libraries, directly resulting in arbitrary code execution on the target server. Because the execution occurs within the security context of the SharePoint application process, the attacker inherits the privileges associated with that service account.\nPost-exploitation impact includes full control over the SharePoint instance, access to sensitive document repositories, database manipulation, and potential pivoting to other segments of the internal enterprise network. The vulnerability exposes the core components responsible for managing business collaboration and data storage, making timely remediation critical."
}