Loading vulnerability…
CVE-2026-26114 is a remote code execution vulnerability in Microsoft Office SharePoint caused by deserialization of untrusted data. The flaw affects Microsoft SharePoint Server and allows an authorized attacker to send crafted serialized data to a vulnerable SharePoint component that improperly deserializes attacker-controlled input. Successful exploitation can result in arbitrary code execution over the network in the context of the targeted SharePoint environment. Available reporting indicates the issue is exploitable by authenticated users with at least Site Member privileges or higher.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository contains both offensive and defensive material centered on CVE-2026-26114, a claimed SharePoint 2019/Subscription Edition attack chain from Taxonomy CSOM SQL injection to OWSTIMER NetDataContractSerializer deserialization RCE. Structure is split into: extensive documentation under docs/, exploit code under exploit/, and a Windows-focused companion patch installer under patch/. The main offensive capability is in exploit/cve_2026_26114_rce.py, a Python PoC that authenticates with NTLM, queries SharePoint REST/CSOM endpoints, creates taxonomy objects, performs blind time-based SQL injection through /_vti_bin/client.svc/ProcessQuery, inserts malicious records into AppInstallations/AppJobs/AppTasks, and relies on OWSTIMER to deserialize attacker-controlled TaskData and execute an arbitrary command. The advanced_patch_test.py script is not just detection; it actively exercises the same attack path with multiple payload variants to validate whether the patch blocks exploitation, using marker files such as C:\Windows\Temp\patch_test_attack*.txt as side-effect checks. The patch/CVE_2026_26114_Patch.py script is a standalone administrative installer for SharePoint servers that deploys SQL audit/trigger controls and modifies OWSTIMER.EXE.CONFIG to enable SerializationGuard. Overall, this is a real exploit repository with an operational PoC plus a defensive patch package; it targets authenticated remote exploitation over SharePoint web endpoints and local SQL/OWSTIMER processing on Windows SharePoint servers.
Repository contains a compact exploit set for CVE-2026-26114 against Microsoft SharePoint: a standalone Python full-chain PoC, a Metasploit module port, and a README with usage examples. The Python script is the primary exploit implementation. It authenticates with NTLM, queries SharePoint REST/CSOM metadata, auto-discovers SiteId/WebId/JobCreatorId and taxonomy identifiers, extracts the content database name via blind time-based SQL injection, creates fresh taxonomy objects, and injects SQL that inserts rogue AppInstallations/AppJobs/AppTasks rows. It then relies on the normal SharePoint AppLifecycle/OWSTIMER processing path so that OWSTIMER deserializes attacker-controlled NetDataContractSerializer TaskData and executes an arbitrary command. The script also supports polling for task pull confirmation and marker-file based verification. The Ruby file is a Metasploit exploit module implementing the same vulnerability chain in a more operational form. It uses SharePoint HTTP endpoints plus an embedded HTTP server to stage a payload executable. Its two-task design keeps each serialized TaskData small enough for the SQLi insertion constraints: one task downloads an EXE with PowerShell from SRVHOST:SRVPORT/URIPATH into C:\Users\Public, and the second executes it. The downloaded EXE is a framework payload, by default a reverse_tcp Meterpreter, making this repository more than a simple PoC. Overall purpose: authenticated remote code execution on vulnerable SharePoint servers by chaining taxonomy SQL injection into AppLifecycle deserialization. Main capabilities include metadata discovery, SQLi-based database row insertion, deserialization-triggered command execution, task-state polling, and staged payload delivery for session establishment.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote code execution vulnerability in Microsoft SharePoint Server caused by deserialization of untrusted data; described as exploitable by authenticated attackers with Site Member permissions.
A Microsoft SharePoint Server remote code execution vulnerability caused by deserialization of untrusted data, exploitable by authenticated users with Site Member permissions or higher.
A remote code execution vulnerability in Microsoft Office SharePoint caused by deserialization of untrusted data (CWE-502), allowing an authorized attacker to execute code over the network.
An important Microsoft SharePoint Server remote code execution vulnerability caused by deserialization of untrusted data. An authenticated attacker with Site Member permissions can execute code remotely over a network.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.