Deserialization of Untrusted Data in Microsoft SharePoint Server - CVE-2026-123390
Published: November 11, 2026
Vulnerability identifier: #VU165485
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-123390
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code in the context of the SharePoint Server.
The vulnerability exists due to deserialization of untrusted data in Microsoft SharePoint Server when processing file parameters through API requests. A remote user can use Site Owner permissions or higher to upload a specially crafted file and send specialized API requests that trigger deserialization to execute arbitrary code in the context of the SharePoint Server.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-123390
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20136