Loading vulnerability…
Microsoft SharePoint Server Deserialization Remote Code Execution
CVE-2026-35439 is a remote code execution vulnerability in on-premises Microsoft SharePoint Server caused by deserialization of untrusted data. SharePoint improperly processes attacker-controlled serialized input without sufficient validation, allowing an authenticated attacker to inject arbitrary code that is executed during deserialization on the SharePoint server. Microsoft indicates exploitation is possible over the network by an authorized user with low privileges, specifically at least Site Owner access. The issue affects supported on-premises SharePoint product lines including SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition prior to the patched builds released in May 2026.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in arbitrary code execution on the underlying SharePoint server in the context of the SharePoint application process. Because the vulnerability has high impact on confidentiality, integrity, and availability, an attacker could use it to access sensitive SharePoint-hosted data, modify content or server-side state, deploy additional payloads, and disrupt service operation.
If you can’t patch tonight, do this now.
No vendor workaround is available in the provided information. Risk reduction measures are therefore limited to minimizing the number of accounts with site-level privileges such as Site Owner, restricting unnecessary network exposure of on-premises SharePoint instances, especially internet-facing deployments, and accelerating installation of the official cumulative security updates.
Patch, then assume compromise.
Apply the Microsoft security updates released in May 2026 for all affected on-premises SharePoint deployments. Patched builds identified in the available information are SharePoint Enterprise Server 2016 build 16.0.5552.1002, SharePoint Server 2019 build 16.0.10417.20128, and SharePoint Server Subscription Edition build 16.0.19725.20280. These updates are cumulative. Environments using SharePoint Workflow Manager must install the required Workflow Manager update before applying the SharePoint cumulative update, and deployments using the Classic version of Workflow Manager require the documented post-update debug-flag configuration to continue functioning.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.