Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T17:19:01.850Z",
  "pubdate": "2026-08-11T17:19:01.850Z",
  "executiveSummary": "A deserialization of untrusted data vulnerability exists in Microsoft Office SharePoint, exposing enterprise environments to remote code execution risks.\nThe vulnerability allows an authorized attacker to execute arbitrary code over the network by supplying specially crafted serialized payloads to vulnerable SharePoint components.\nThe primary impact of successful exploitation includes complete system compromise, unauthorized access to sensitive data stored within SharePoint repositories, and potential lateral movement across the internal network.\nThis flaw represents a significant risk to organizational confidentiality, integrity, and availability.\nExploitation requires the attacker to possess authorized network access to the target SharePoint deployment, meaning the adversary must already have authenticated credentials or valid session access within the trust boundary.\nNo specific version numbers, file paths, or complex prerequisites beyond authentication and network connectivity are detailed in the provided data.",
  "technicalDetails": "The root cause of the vulnerability stems from insecure deserialization practices within Microsoft Office SharePoint.\nInsecure deserialization occurs when untrusted input is processed by the application's object deserialization routines without adequate validation, sanitization, or type checking.\nWhen SharePoint ingests serialized data streams provided by an authorized user, the underlying parser instantiates objects and invokes methods defined within the payload.\nAn authorized attacker leverages this behavior by constructing a malicious serialized object chain designed to trigger unintended code execution upon deserialization.\nThe attack flow proceeds as follows: First, the attacker establishes network communication with the vulnerable Microsoft Office SharePoint instance. Second, leveraging authorized access, the attacker transmits a crafted request containing the malicious serialized payload to the vulnerable endpoint or component. Third, the SharePoint server receives the input and processes the stream through its insecure deserialization mechanism. Fourth, the runtime environment reconstructs the objects, triggering gadget chains or insecure callback functions embedded within the payload. Finally, this execution flow culminates in arbitrary code execution within the context of the SharePoint service account.\nThe affected component involves the data handling and parsing routines responsible for managing serialized objects within Microsoft Office SharePoint.\nNetwork exposure is present over the network protocol utilized by SharePoint services, allowing remote exploitation provided the attacker meets the authentication requirements.\nPrivilege requirements mandate that the attacker must be an authorized user to interact with the vulnerable parsing component.\nPost-exploitation impact includes full code execution capabilities, enabling the attacker to manipulate underlying data, escalate privileges locally, deploy persistence mechanisms, or pivot to other network segments accessible from the SharePoint server."
}