Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T17:19:02.233Z",
  "pubdate": "2026-08-11T17:19:02.233Z",
  "executiveSummary": "A deserialization of untrusted data vulnerability exists in Microsoft Office SharePoint, exposing the affected systems to remote code execution risks. This security flaw enables an authorized attacker to transmit specially crafted payloads across the network to the vulnerable application. Upon processing the untrusted serialized data without adequate validation or sanitization, the underlying application instantiates objects in an insecure manner, allowing the execution of arbitrary code within the context of the service account. The risk implications are severe, as successful exploitation could lead to full system compromise, data exfiltration, or lateral movement within the enterprise network. Exploitation prerequisites require the attacker to possess authorized network access to the SharePoint environment, meaning the threat actor must already have valid credentials or an established foothold within the authorization boundary. Mitigating this risk requires strict adherence to vendor-supplied security updates and adherence to secure deserialization practices.",
  "technicalDetails": "The vulnerability resides in the insecure handling and deserialization of untrusted data streams within Microsoft Office SharePoint components responsible for parsing complex object graphs. The root cause stems from the application accepting serialized data streams from network-authenticated users and reconstructing them without properly enforcing type safety, employing secure binders, or validating the integrity and provenance of the incoming objects. During the deserialization routine, the application instantiates types and invokes methods defined within the payload, allowing threat actors to leverage existing gadget chains present in the classpath or application dependencies.\nThe attack flow proceeds as follows: First, the authorized attacker crafts a malicious serialized payload engineered to trigger a specific gadget chain upon object instantiation. Second, the attacker transmits this payload over the network via standard protocols utilized by the SharePoint service endpoints, targeting the vulnerable deserialization routines. Third, the SharePoint server receives the network request and passes the untrusted byte stream to the vulnerable deserialization component. Fourth, as the framework reconstructs the object graph, it executes the embedded methods or properties within the gadget chain, bypassing standard execution flow restrictions. Fifth, the execution of the payload results in arbitrary code execution on the host operating system with the privileges assigned to the SharePoint worker process or service account.\nAuthentication requirements dictate that the attacker must possess valid credentials to access the vulnerable network services within SharePoint. Privilege requirements necessitate at least authorized access, meaning unauthenticated external attackers cannot directly exploit the flaw without prior credential compromise. The network exposure is broad, as SharePoint services are typically accessible across internal networks or via published enterprise portals. The post-exploitation impact includes complete administrative control over the SharePoint application layer, potential access to underlying databases containing sensitive organizational documents, and the capability to pivot to other networked enterprise systems."
}