Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T17:19:09.760Z",
  "pubdate": "2026-08-11T17:19:09.760Z",
  "executiveSummary": "A deserialization of untrusted data vulnerability exists in Microsoft Office SharePoint, exposing the software to remote code execution risks.\nThe vulnerability allows an authorized remote attacker to execute arbitrary code over a network within the context of the SharePoint application.\nAffected systems include Microsoft Office SharePoint Server deployments that improperly handle serialized objects derived from untrusted user input.\nThe risk implications are severe, as successful exploitation compromises the confidentiality, integrity, and availability of the underlying server infrastructure and stored enterprise data.\nAttacker capabilities include complete system compromise, leveraging the execution context of the vulnerable SharePoint service to deploy further payloads or pivot through connected network segments.\nExploitation requirements dictate that the threat actor must possess authorized access to the SharePoint environment, enabling them to supply specially crafted serialized payloads to the susceptible deserialization routines.",
  "technicalDetails": "The vulnerability stems from the insecure handling and deserialization of untrusted data streams within Microsoft Office SharePoint components. When the application reconstructs data structures from serialized input streams without proper type validation or cryptographic integrity checks, malicious objects can be injected.\nThe root cause lies in the application programming interfaces and internal libraries responsible for processing serialized payloads. If these components instantiate arbitrary classes or invoke dangerous methods during the deserialization lifecycle, memory manipulation and arbitrary code execution can occur.\nThe exploitation method involves an authorized attacker crafting a malicious serialized payload designed to leverage gadget chains—sequences of existing application or framework classes that trigger unintended actions when their state is restored.\nThe attack flow begins when the threat actor transmits the crafted serialized object over the network to a vulnerable endpoint within Microsoft Office SharePoint. The receiving component processes the input and initiates the deserialization sequence.\nDuring the deserialization process, the crafted payload invokes target gadget methods, leading to memory corruption or direct execution of native or managed code provided by the attacker.\nAuthentication requirements specify that the attacker must be authorized within the network environment to interact with the vulnerable SharePoint services capable of accepting the serialized input.\nPrivilege requirements involve having sufficient access rights to submit the payload to the specific vulnerable endpoint or interface exposed by the application.\nNetwork exposure is defined by the accessibility of the Microsoft Office SharePoint instance over the network, allowing remote transmission of the malicious data stream.\nPost-exploitation impact includes full remote code execution, enabling the attacker to install persistent backdoors, escalate privileges, access sensitive SharePoint databases, and compromise adjacent systems within the corporate network architecture."
}