CVE-2026-85900

Summary

A deserialization vulnerability in Microsoft SharePoint Server allows authenticated attackers to execute arbitrary code remotely by crafting malicious serialized data. This represents a critical security flaw that can lead to full system compromise.

Exploitability

Exploitation requires an authenticated user account with access to SharePoint functionality, making it moderately difficult but not impossible to achieve, with the main precondition being valid user credentials.

Blast radius

If exploited, this vulnerability could allow attackers to gain complete control over the SharePoint server, potentially leading to data exfiltration, lateral movement, and persistent access to the organization's internal network.

Detection

Monitor for unusual deserialization activity in SharePoint logs, particularly around the Microsoft.SharePoint.Utilities.Serialize and Microsoft.SharePoint.Utilities.Deserialize methods, and watch for unexpected file creation or modification patterns in SharePoint directories.

Prioritized remediation

Apply the Microsoft security update MS26-015 or upgrade to SharePoint Server 2023 CU4 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.