CVE-2026-65665 – Microsoft SharePoint Server Remote Code Execution Vulnerability

Microsoft SharePoint Server contains a critical remote code execution vulnerability caused by deserialization of untrusted data. An authenticated attacker with at least Site Owner privileges could inject arbitrary code and execute it remotely on a vulnerable SharePoint Server. Successful exploitation could have a high impact on confidentiality, integrity, and availability.

CVSS Score: 8.8.

SEVERITY: Critical.

THREAT:
The vulnerability is network-accessible, has low attack complexity, and requires low privileges with no user interaction. Successful exploitation could allow arbitrary code execution on the SharePoint Server. It is assessed as “Exploitation More Likely.”

EXPLOITS:
This vulnerability is not publicly disclosed and is not currently exploited. Exploit code maturity is listed as Unproven, so no confirmed public exploit, zero-day exploitation, or proof-of-concept code can be established from the source information.

TECHNICAL SUMMARY:
CVE-2026-65665 is a deserialization of untrusted data vulnerability (CWE-502) in Microsoft Office SharePoint. In a network-based attack, an authenticated attacker with at least Site Owner privileges could write arbitrary code that is injected and executed remotely on the SharePoint Server. Attack complexity is low, scope remains unchanged, and successful exploitation can have high confidentiality, integrity, and availability impact.

EXPLOITABILITY:
Affected products are Microsoft SharePoint Server 2019 and Microsoft SharePoint Server Subscription Edition. Exploitation requires an authenticated attacker with at least Site Owner privileges, but no user interaction is required.

BUSINESS IMPACT:
Successful exploitation could allow an attacker to execute arbitrary code on a SharePoint Server, threatening sensitive information, system integrity, and service availability. For organizations relying on SharePoint for collaboration and business content, compromise could disrupt operations and expose critical organizational data.

WORKAROUND:
No workaround or mitigation is identified. Apply all applicable security updates offered for the installed SharePoint software; some affected installations require multiple update packages.

URGENCY:
This is a Critical remote code execution vulnerability with a CVSS base score of 8.8 and an “Exploitation More Likely” assessment. Its network attack vector, low attack complexity, and lack of required user interaction make timely deployment important. Apply all applicable updates for affected SharePoint installations.