Microsoft SharePoint Server: Remote Code Execution through deserialization
Summary
A deserialization flaw in Microsoft Office SharePoint allows an attacker with a low-privileged account to execute code on the server over the network. The CVSS vector rates the attack complexity as high, so exploitation requires specific conditions. Exposure of on-premises SharePoint servers to the internet raises the risk considerably.
Affected
- Microsoft SharePoint Server Subscription Edition (on-premises): 16.0.0 before 16.0.20326.20278
- SharePoint Server 2019 and 2016: unknown, not listed in the sources reviewed
- SharePoint Online: likely not affected, not verified from a primary source
Fixed in
- Microsoft SharePoint Server Subscription Edition: 16.0.20326.20278 or later (according to the CNA record, to be confirmed against the MSRC advisory)
- Fixes for 2019 and 2016: unknown
Workaround
- No CVE-specific workaround from Microsoft found. Unknown until the MSRC advisory is checked.
- General CISA guidance for SharePoint: avoid direct internet exposure; where unavoidable, use a Layer 7 reverse proxy or equivalent control that enforces authentication.
- Verify that AMSI integration is enabled for each SharePoint web application.
- Block external access to SharePoint Central Administration.
Exploitation
- No evidence of exploitation in the wild found. CISA SSVC: exploitation none, automatable no, technical impact total.
- CVSS exploit maturity: Unproven (E:U).
- No public proof of concept found.
- Rapid7 reports Microsoft is aware of in-the-wild exploitation for one vulnerability published on the same day; whether it is this CVE is unknown.
Our recommendation
- Check whether any on-premises SharePoint server runs Subscription Edition below 16.0.20326.20278, and check SharePoint 2016 and 2019 separately against the MSRC advisory.
- Patch affected servers promptly. If patching is delayed, remove direct internet exposure first.
- Review accounts with SharePoint access and rotate credentials if there are signs of compromise.
- Monitor the MSRC page and the CISA KEV catalogue for updates, since NVD analysis is still pending.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Microsoft Office SharePoint
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002945
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-120000 (CVE.org) www.cve.org
- Microsoft Security Response Center advisory msrc.microsoft.com
- CISA: SharePoint hardening after new exploitations www.cisa.gov
- Rapid7 Patch Tuesday review, November 2026 www.rapid7.com
- Strix CVE-2026-120000 www.strix.ai
- CVE-2026-120000 third-party record (threatint) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:23.
Original description (NVD)
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.