Loading vulnerability…
Remote Code Execution in Microsoft SharePoint Server via Insecure Deserialization
CVE-2026-40357 is a remote code execution vulnerability in on-premises Microsoft Office SharePoint and SharePoint Server caused by deserialization of untrusted data. SharePoint improperly processes attacker-controlled serialized input without sufficient validation, allowing an authenticated user to trigger unsafe deserialization over the network. Microsoft states that exploitation requires only low privileges, specifically a minimum of Site Member permissions, and no user interaction. The issue affects supported on-premises SharePoint releases prior to the May 2026 security updates, including SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution on the target SharePoint Server in the context of the SharePoint application process. Because the vulnerability has high impact on confidentiality, integrity, and availability, an attacker could use it to access sensitive data, modify content or server-side state, deploy additional payloads, and disrupt SharePoint services. In practical terms, compromise of the SharePoint server can provide a foothold for broader intrusion into the surrounding enterprise environment.
If you can’t patch tonight, do this now.
No alternative workaround is available in the provided information. If immediate patching is not possible, risk can only be reduced operationally by limiting SharePoint exposure, minimizing assignment of Site Member and other unnecessary authenticated access, and restricting access to internet-facing or untrusted networks until the official updates are installed.
Patch, then assume compromise.
Apply the May 12, 2026 Microsoft security updates for affected on-premises SharePoint versions. Patched builds identified in the available information are SharePoint Enterprise Server 2016 build 16.0.5552.1002, SharePoint Server 2019 build 16.0.10417.20128, and SharePoint Server Subscription Edition build 16.0.19725.20280. These updates are cumulative. Environments running SharePoint Workflow Manager must install KB5002799 before applying the cumulative SharePoint update. Microsoft states that applying the official fix is the supported remediation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.