Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
In plain language
Written by AI from the record
This Microsoft SharePoint Server issue lets an attacker run custom code on your server over the network with low authentication; most small businesses running SharePoint should act now if your SharePoint is reachable and attackers could obtain a valid account.
Authenticated attacker can trigger remote code execution in Microsoft SharePoint Server via unsafe handling of untrusted input (CWE-502: deserialization of untrusted data), allowing arbitrary code execution over the network with low user interaction.
If you're affected
Full SharePoint server takeover
Malware installation on server
Data theft or exposure
Service outage or disruption
What is it
Think of SharePoint like your business’s document hub. This vulnerability is a bug where SharePoint can accidentally “trust” unsafe input it receives, and that mistake can let an attacker make the server run attacker-controlled code. If exploited, it can lead to a complete compromise of your SharePoint server and the data it holds.
Who is affected
This matters if you run Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, or “sharepoint server” and users can access it. It’s mainly a risk when an attacker can get an authenticated account and reach the SharePoint system over the network (the default configuration is reachable). The main gate is attacker access: it requires an authenticated attacker.
How urgent is it
This is RED because the flaw allows remote code execution and is reachable in default configuration. Even though exploitation details aren’t clearly dated in the news and no public exploit code is on record, the activity tracked by the patch/actor reporting indicates active attention on this issue, so you should patch immediately on your next maintenance window—ideally as soon as possible.
What to do — in detail
Confirm exposure (what to check)
Identify which exact product you run: Microsoft SharePoint Server 2019 or Microsoft SharePoint Server Subscription Edition (sharepoint server).
Determine your installed SharePoint build/version.
Confirm whether SharePoint is reachable from the network in your setup (especially if it’s publicly accessible).
Determine whether you’re affected
If your current build is older than the fixed versions listed by Microsoft, you are considered at risk.
Apply the fixed versions (target states)
Microsoft SharePoint Server 2019 → upgrade to 16.0.10417.20198.
Microsoft SharePoint Server Subscription Edition (sharepoint server) → upgrade to 16.0.19725.20522.
Use Microsoft’s update guidance page for the correct installation/update procedure for your environment.
If patching is delayed (practical interim steps)
Reduce the chance an attacker can reach the server over the network where possible (restrict inbound access to only required networks/clients).
Strengthen account security because exploitation requires an authenticated attacker: ensure strong passwords, disable unused accounts, and review recent sign-in activity.
Monitor logs for unusual sign-ins and unexpected application/server behavior around the time of any suspicious activity.
After the upgrade
Re-check the SharePoint build/version to ensure the fixed level is installed.
Review relevant security and SharePoint logs for suspicious activity that may have occurred before patching.
CISA due date
Not applicable here because this CVE is not listed in CISA KEV (per the findings).
Technical context
Severity and verdict: Rated HIGH by CVSS (8.8) and treated as RED for action priority.
Mechanism: CWE-502 (deserialization of untrusted data). Microsoft SharePoint Server processes unsafe/untrusted input in a way that can be abused so an authenticated attacker can cause the server to execute attacker-controlled code.
Attack vector and requirements: Network-based trigger with low authentication; no user interaction is required. A key precondition is that the attacker must be an authenticated user of the Microsoft Office SharePoint system.
Exploitation status: No clear dated press exploitation claim and no public exploit code were found in the provided findings. KEV listing is not present. However, actor/press attention tracking indicates focus on this issue.
EPSS: A predicted likelihood exists (flat trend), but because this is a RED item, the operational response is driven by the vulnerability’s impact and current active attention rather than prediction alone.
What KEV means here: Because it is not listed in CISA KEV, there isn’t an official CISA “known exploited” timeline captured in the findings.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
