Deserialization of Untrusted Data in Microsoft SharePoint Server - CVE-2026-120000
Published: November 11, 2026
Vulnerability identifier: #VU165408
CSH Severity: Low
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-120000
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code on the affected SharePoint server.
The vulnerability exists due to deserialization of untrusted data in Microsoft Office SharePoint when processing user-supplied serialized data. A remote user can supply crafted serialized data to execute arbitrary code on the affected server.
Exploitation requires an account with permission to add content and personalize an existing page.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-120000
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20278