Microsoft patched multiple Exchange and SharePoint remote code execution flaws

Microsoft disclosed and patched several remote code execution vulnerabilities affecting Exchange Server and SharePoint Server, including Exchange flaws tracked as CVE-2023-21706, CVE-2023-28310, and CVE-2023-36439, alongside SharePoint issues CVE-2026-33110, CVE-2026-33112, and CVE-2026-40368. The SharePoint vulnerabilities were tied to deserialization of untrusted data and were rated Important, with CVSS scores of 8.8 for CVE-2026-33110 and CVE-2026-33112, and 8.0 for CVE-2026-40368.

Microsoft said CVE-2026-33110 could let an authenticated attacker with at least Site Member permissions execute code remotely on a vulnerable SharePoint Server, while CVE-2026-33112 required at least Site Owner privileges to inject and run arbitrary code. For CVE-2026-40368, exploitation involved a client connecting to a malicious server, potentially leading to code execution on the client. Microsoft reported that the SharePoint flaws were not publicly disclosed and not exploited in the wild at publication, assessed exploitation as less likely, and released fixes, including a shared KB update for SharePoint Server 2016 and SharePoint Enterprise Server 2016.