Loading vulnerability…
Remote Code Execution in Microsoft SharePoint Server via Deserialization of Untrusted Data
CVE-2026-33110 is a remote code execution vulnerability in on-premises Microsoft SharePoint Server caused by deserialization of untrusted data. SharePoint improperly processes attacker-controlled serialized input, allowing an authenticated attacker to trigger code execution on the target server over the network. Publicly available information identifies the issue as affecting SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition prior to the patched builds released in May 2026. The specific vulnerable component or function has not been publicly disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution in the context of the SharePoint application on the underlying server. Because the vulnerability is rated with high impact to confidentiality, integrity, and availability, an attacker could use it to access or manipulate SharePoint-hosted content, disrupt service operation, establish persistence, or leverage the compromised server for further movement within the environment.
If you can’t patch tonight, do this now.
No workaround has been reported for this vulnerability. Risk reduction is therefore limited to promptly applying the vendor updates and minimizing unnecessary low-privilege SharePoint access, particularly on internet-facing or externally reachable on-premises deployments, until patching is complete.
Patch, then assume compromise.
Apply the Microsoft security updates released in May 2026 for all affected on-premises SharePoint editions. Reported fixed builds are SharePoint Enterprise Server 2016 build 16.0.5552.1002 via KB5002868, SharePoint Server 2019 build 16.0.10417.20128 via KB5002870, and SharePoint Server Subscription Edition build 16.0.19725.20280 via KB5002863. Environments using SharePoint Workflow Manager must install KB5002799 before applying the cumulative SharePoint update. Microsoft indicates the remediation status is an official fix and customer action is required.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.