cbcvebase.
CVE-2026-26114
published 2026-03-10

CVE-2026-26114: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

PriorityP261high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
2.41%
82.2th percentile
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Affected

6 ranges
VendorProductVersion rangeFixed in
microsoftmicrosoft_sharepoint_enterprise_server_2016>= 16.0.0 < 16.0.5543.100016.0.5543.1000
microsoftmicrosoft_sharepoint_server_2019>= 16.0.0 < 16.0.10417.2010216.0.10417.20102
microsoftsharepoint_server
microsoftsharepoint_server
msrcmicrosoft_sharepoint_enterprise_server_2016
msrcmicrosoft_sharepoint_server_2019

Detection & IOCsextracted from sources · hover to see the quote

  • Attacker must be authenticated with at minimum Site Member permissions (PR:L) to exploit this SharePoint deserialization RCE — monitor for unusual authenticated requests to SharePoint Server endpoints that may trigger deserialization.
  • Any authenticated user (not just admins) can trigger this vulnerability — low-privilege SharePoint accounts should be treated as potential attack vectors; audit Site Member activity for anomalous behavior.
  • Exploitation vector is network-based deserialization of untrusted data in Microsoft Office SharePoint — inspect network traffic to SharePoint for malformed or unexpected serialized payloads.
  • ·SharePoint Server 2016 and SharePoint Enterprise Server 2016 share the same KB update number — ensure both product variants are patched using the same security update.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.