Deserialization of Untrusted Data in Microsoft SharePoint Server - CVE-2026-110044
Published: November 10, 2026
Vulnerability identifier: #VU164758
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-110044
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code on the affected SharePoint server.
The vulnerability exists due to deserialization of untrusted data in Microsoft SharePoint Server when processing network requests from users with Site Member permissions on an affected site. A remote user can send a specially crafted request to execute arbitrary code on the server.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-110044
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20278