Microsoft Fixes Multiple Remote Code Execution Flaws Across SharePoint, Edge, Azure, and Power Pages

Microsoft published security advisories for several remote code execution vulnerabilities affecting SharePoint, Microsoft Edge (Chromium-based), Azure Orbital Spatio, Azure Virtual Network Gateway, and Microsoft Power Pages, including CVE-2026-45659, CVE-2026-45495, CVE-2026-40412, CVE-2026-40411, and CVE-2026-23652. The most detailed disclosures focused on SharePoint Server, where Microsoft described CVE-2026-35439 and CVE-2026-40357 as deserialization of untrusted data flaws that could let authenticated attackers execute arbitrary code over the network on vulnerable servers.

Microsoft rated both SharePoint issues Important with CVSS 8.8 and said exploitation requires valid access, with CVE-2026-35439 requiring at least Site Owner privileges and CVE-2026-40357 requiring Site Member permissions. The company said neither flaw had been publicly disclosed or exploited in the wild at publication and assessed exploitation as less likely, while providing fixes that also apply to both SharePoint Server 2016 and SharePoint Enterprise Server 2016. Microsoft also disclosed CVE-2026-40362, an Excel heap-based buffer overflow that can lead to remote code execution if a user opens a malicious Office file; Microsoft said the Preview Pane is not an attack vector and that a patch is available.