Executive brief
Microsoft SharePoint is a widely used collaboration and document management platform for businesses. A security vulnerability has been identified that allows an attacker with basic user permissions to run unauthorized commands on the server. This could lead to a complete takeover of the SharePoint environment, resulting in the theft of sensitive corporate data or a total disruption of business operations.
Technical details
A remote code execution vulnerability exists in Microsoft SharePoint Server due to the unsafe deserialization of untrusted data. The flaw is rooted in insufficient granularity of access controls (CWE-1220), which allows an authenticated attacker with low-privileged user permissions to send specially crafted network requests to the server. Successful exploitation enables the attacker to execute arbitrary code in the context of the SharePoint service account. Affected versions include SharePoint Server 2016, 2019, and Subscription Edition; Microsoft has released security updates to address this issue.
Affected products
- Microsoft SharePoint Server 2016 Enterprise Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server Subscription Edition up to (excluding) 16.0.19725.20280
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory: Initial advisory published by Microsoft
- 2026-06-01: other: Description updated to specify deserialization as the root cause