Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-105013 Overview
CVE-2026-105013 is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint. An authenticated attacker with low privileges can execute code over a network by submitting crafted serialized objects. The flaw is tracked under CWE-502 and affects Microsoft SharePoint Server subscription edition.
Microsoft published the advisory through the Microsoft Security Response Center (MSRC) on October 13, 2026. Because the scope is marked as changed, a successful exploit can impact resources beyond the vulnerable SharePoint component.
Critical Impact
Authenticated attackers can trigger remote code execution against SharePoint Server over the network, enabling lateral movement into collaboration content, workflows, and connected enterprise services.
Affected Products
- Microsoft SharePoint Server (subscription edition)
- Deployments exposing SharePoint endpoints to authenticated users
- Downstream services integrated with SharePoint workflows and APIs
Discovery Timeline
- 2026-10-13 - CVE-2026-105013 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-105013
Vulnerability Analysis
The vulnerability stems from unsafe deserialization of attacker-controlled data within Microsoft SharePoint Server. SharePoint processes serialized objects as part of its request handling, and insufficient type validation permits gadget chains to execute during object reconstruction.
An authenticated attacker with low privileges can submit a crafted payload to a vulnerable endpoint. SharePoint deserializes the data in a privileged context, triggering code execution on the server. Because the attack is remote and requires no user interaction, exploitation can be automated against reachable SharePoint instances.
The EPSS probability is 0.84% with a percentile of 57.006 as of October 15, 2026. No public proof-of-concept exploit is listed, and the vulnerability is not currently on the CISA Known Exploited Vulnerabilities list.
Root Cause
The root cause is classified under CWE-502: Deserialization of Untrusted Data. SharePoint reconstructs objects from untrusted input without enforcing strict type binders or allowlists. Gadget classes available in the SharePoint runtime provide the primitives needed to pivot deserialization into arbitrary code execution.
Attack Vector
The attack vector is network based. An attacker authenticates to SharePoint with low privileges, then submits a crafted serialized object to a vulnerable handler. SharePoint deserializes the payload and executes attacker-controlled logic. Because the scope changes during exploitation, impact can extend to adjacent services and identities the SharePoint process can reach.
For technical specifics, refer to the Microsoft CVE-2026-105013 Update Guide.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-105013
Indicators of Compromise
- Unexpected w3wp.exe child processes such as cmd.exe, powershell.exe, or rundll32.exe spawning from SharePoint application pools.
- Outbound network connections initiated by SharePoint worker processes to unfamiliar hosts.
- New or modified .aspx, .ashx, or .asmx files in SharePoint content directories outside scheduled deployments.
- Anomalous authenticated POST requests containing large base64 or binary payloads to SharePoint endpoints.
Detection Strategies
- Monitor Windows event logs and SharePoint ULS logs for deserialization exceptions and unexpected assembly loads.
- Correlate authenticated SharePoint sessions with process creation events to flag code execution originating from the IIS worker process.
- Alert on w3wp.exe writing executables or scripts to disk, or launching interactive shells.
Monitoring Recommendations
- Enable detailed IIS and SharePoint request logging and forward events to a central SIEM.
- Baseline normal SharePoint process behavior and alert on deviations in child processes, loaded modules, and network destinations.
- Review authentication logs for low-privilege accounts performing unusual API or workflow interactions.
How to Mitigate CVE-2026-105013
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-105013 as soon as possible.
- Inventory all SharePoint Server subscription edition instances and prioritize internet-exposed servers for patching.
- Rotate credentials and service account secrets used by SharePoint if post-exploitation activity is suspected.
- Review recent authenticated access to SharePoint and investigate anomalous sessions.
Patch Information
Microsoft has published the fix through the Microsoft CVE-2026-105013 Update Guide. Administrators should install the referenced cumulative or security update on all SharePoint Server subscription edition deployments and validate successful installation through the SharePoint Central Administration dashboard.
Workarounds
- Restrict SharePoint access to trusted networks using firewall rules or reverse proxies while patching is scheduled.
- Enforce multi-factor authentication to raise the cost of obtaining the low-privilege account required for exploitation.
- Remove unnecessary permissions from low-privilege user roles that can reach vulnerable endpoints.
- Increase monitoring on SharePoint hosts until the security update is deployed and verified.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
