Loading vulnerability…
Remote Code Execution in Microsoft Office SharePoint
CVE-2026-40368 is a remote code execution vulnerability in Microsoft Office SharePoint caused by deserialization of untrusted data. SharePoint processes attacker-controlled serialized data without sufficient validation, enabling code execution in a network-accessible attack path. Microsoft characterizes the issue as exploitable by an authenticated attacker with low privileges, with user interaction required. Available vendor context indicates exploitation involves a client connecting to a malicious server, after which the unsafe deserialization condition can lead to code execution on the client. The vulnerability affects supported on-premises SharePoint product lines addressed by Microsoft's May 2026 security updates, including SharePoint Server 2016 / SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in remote code execution with high impact to confidentiality, integrity, and availability. An attacker who can trigger the vulnerable deserialization path may execute arbitrary code in the affected SharePoint-related context, enabling compromise of data, modification of content or application state, and potential service disruption. Microsoft rated the issue Important and assigned a CVSS 3.1 base score of 8.0.
If you can’t patch tonight, do this now.
No alternative workaround is currently available in the provided information. Risk reduction measures include limiting unnecessary authenticated access and low-privilege SharePoint roles, restricting exposure of SharePoint environments to untrusted networks where feasible, and prioritizing patching of internet-facing deployments. The primary mitigation is prompt installation of the vendor fix.
Patch, then assume compromise.
Apply the official Microsoft security updates released in May 2026 for affected SharePoint versions. Reported fixed builds include SharePoint Enterprise Server 2016 / SharePoint Server 2016 build 16.0.5552.1002, SharePoint Server 2019 build 16.0.10417.20128, and SharePoint Server Subscription Edition build 16.0.19725.20280. In environments using SharePoint Workflow Manager, install the prerequisite Workflow Manager update identified by Microsoft before applying the cumulative SharePoint update. Microsoft indicates the SharePoint security updates are cumulative.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.