CVE-2026-26114

CWE-502 — Deserialization of Untrusted Data5 documents5 sources
Severity
8.8HIGH
EPSS
1.6%
top 18.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Microsoft Microsoft Sharepoint Enterprise Server 2016Microsoft Microsoft Sharepoint Server 2019Microsoft Sharepoint Server
Timeline
PublishedMar 10

Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5microsoft/microsoft_sharepoint_server_201916.0.0 — 16.0.10417.20102
▶CVEListV5microsoft/microsoft_sharepoint_enterprise_server_201616.0.0 — 16.0.5543.1000
▶NVDmicrosoft/sharepoint_server2016, 2019+1

🔴Vulnerability Details

2
CVEList
Microsoft SharePoint Server Remote Code Execution Vulnerability↗2026-03-10
▶
GHSA
GHSA-mh49-cvp3-vvc2: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network↗2026-03-10
▶

📋Vendor Advisories

1
Microsoft
Microsoft SharePoint Server Remote Code Execution Vulnerability↗2026-03-10
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-26114 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶