# CVE-2026-40365: Microsoft SharePoint remote code execution via unsafe deserialization

Source: https://junglewise.ai/threats/cve-2026-40365-microsoft-sharepoint-remote-code-execution-via-unsafe  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-40365 · Severity: high · CVSS 8.8 · Published 2026-05-12

Microsoft SharePoint is a widely used collaboration and document management platform for businesses. A security vulnerability has been identified that allows an attacker with basic user permissions to run unauthorized commands on the server. This could lead to a complete takeover of the SharePoint environment, resulting in the theft of sensitive corporate data or a total disruption of business operations.

Technologies: [Microsoft SharePoint Server 2016 Enterprise Edition](https://junglewise.ai/threats/technologies/sharepoint-server-2016-enterprise-edition), [Microsoft SharePoint Server 2019](https://junglewise.ai/threats/technologies/sharepoint-server-2019), [Microsoft SharePoint Server Subscription Edition](https://junglewise.ai/threats/technologies/sharepoint-server-subscription-edition). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-40365 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40365 being exploited in the wild.

**How severe is CVE-2026-40365?** High severity, with a CVSS score of 8.8, published 12 May 2026.

**Which products and versions are affected?** Microsoft SharePoint Server Subscription Edition up to (excluding) 16.0.19725.20280.

**Is there a fix for CVE-2026-40365?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40365 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40365?** Check whether you run Microsoft SharePoint Server 2016 Enterprise Edition, Microsoft SharePoint Server 2019 or Microsoft SharePoint Server Subscription Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A remote code execution vulnerability exists in Microsoft SharePoint Server due to the unsafe deserialization of untrusted data. The flaw is rooted in insufficient granularity of access controls (CWE-1220), which allows an authenticated attacker with low-privileged user permissions to send specially crafted network requests to the server. Successful exploitation enables the attacker to execute arbitrary code in the context of the SharePoint service account. Affected versions include SharePoint Server 2016, 2019, and Subscription Edition; Microsoft has released security updates to address this issue.

## Affected products

- Microsoft SharePoint Server 2016 Enterprise Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server Subscription Edition up to (excluding) 16.0.19725.20280

## Timeline

- 2026-05-12: disclosed
- 2026-05-12: advisory: Initial advisory published by Microsoft
- 2026-06-01: other: Description updated to specify deserialization as the root cause

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40365](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40365)

## Related threats

- [Microsoft SharePoint cross-site scripting vulnerability](https://junglewise.ai/threats/cve-2026-62826-microsoft-sharepoint-cross-site-scripting-vulnerability)
- [Microsoft SharePoint improper authorization privilege escalation](https://junglewise.ai/threats/cve-2026-58277-microsoft-sharepoint-improper-authorization-privilege-escalation)
- [Microsoft SharePoint improper access control spoofing vulnerability](https://junglewise.ai/threats/cve-2026-56157-microsoft-sharepoint-improper-access-control-spoofing)
- [Microsoft Office Word numeric truncation information disclosure](https://junglewise.ai/threats/cve-2026-55142-microsoft-office-word-numeric-truncation-information-disclosure)
- [Microsoft Office SharePoint cross-site scripting](https://junglewise.ai/threats/cve-2026-55135-microsoft-office-sharepoint-cross-site-scripting)