Loading vulnerability…
Remote Code Execution in Microsoft SharePoint Server Deserialization
CVE-2026-33112 is an authenticated remote code execution vulnerability in on-premises Microsoft SharePoint Server caused by deserialization of untrusted data. SharePoint improperly deserializes attacker-controlled serialized input without sufficient validation, allowing a low-privileged authenticated user to supply a malicious serialized object that triggers arbitrary code execution when processed by the vulnerable server-side component. Microsoft classified the issue as Important and described exploitation as possible over the network with low attack complexity and no user interaction. Affected products include SharePoint Server Subscription Edition before build 16.0.19725.20280, SharePoint Server 2019 before build 16.0.10417.20128, and SharePoint Enterprise Server 2016 before build 16.0.5552.1002.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution on the SharePoint server in the context of the SharePoint application process. This can lead to full compromise of the affected server, including access to sensitive data, unauthorized modification of SharePoint content or configuration, and disruption of service availability. The vulnerability has high impact on confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
No vendor workaround or alternative mitigation is available in the provided information. Until patching is completed, reducing unnecessary authenticated access and restricting elevated SharePoint site roles such as Site Owner may reduce exposure, but applying the official Microsoft security update is the only supported corrective action.
Patch, then assume compromise.
Apply Microsoft's May 2026 security updates for all affected on-premises SharePoint deployments. Fixed versions identified in the available information are SharePoint Server Subscription Edition build 16.0.19725.20280, SharePoint Server 2019 build 16.0.10417.20128, and SharePoint Enterprise Server 2016 build 16.0.5552.1002. In environments using SharePoint Workflow Manager, the required prerequisite update must be installed before applying the cumulative SharePoint security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.