SB20261111118 - Multiple vulnerabilities in Microsoft SharePoint Server

Description

This security bulletin contains information about 2 vulnerabilities.

1) Deserialization of Untrusted Data (CVE-ID: CVE-2026-123390)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code in the context of the SharePoint Server.

The vulnerability exists due to deserialization of untrusted data in Microsoft SharePoint Server when processing file parameters through API requests. A remote user can use Site Owner permissions or higher to upload a specially crafted file and send specialized API requests that trigger deserialization to execute arbitrary code in the context of the SharePoint Server.

2) Incorrect authorization (CVE-ID: CVE-2026-123391)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges and modify protected content or administrative configuration.

The vulnerability exists due to incorrect authorization in Microsoft SharePoint Server when handling requests. A remote user can send a specially crafted request to perform operations beyond the permissions granted to their account to escalate privileges and modify protected content or administrative configuration.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-123390
• https://support.microsoft.com/help/5002908
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-123391