CVE-2026-33110: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-33110 Overview

CVE-2026-33110 is a deserialization of untrusted data vulnerability [CWE-502] in Microsoft Office SharePoint Server. An authenticated attacker can submit a crafted serialized object to a vulnerable endpoint and trigger arbitrary code execution on the server. The flaw affects multiple supported SharePoint Server editions, including Subscription Edition, 2019, and 2016. Microsoft assigned a CVSS 3.1 score of 8.8 and rates the issue High. Exploitation requires low privileges and no user interaction, making post-authentication compromise of SharePoint a realistic path to full server takeover. Successful exploitation impacts confidentiality, integrity, and availability of the SharePoint farm.

Critical Impact

An authorized attacker with low-privileged access can execute arbitrary code on a SharePoint server over the network, leading to data theft, lateral movement, and farm-wide compromise.

Affected Products

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

• 2026-05-12 - CVE-2026-33110 published to the National Vulnerability Database
• 2026-05-13 - Last updated in NVD database
• 2026-05-17 - EPSS score recorded at 0.555% (percentile 68.34)

Technical Details for CVE-2026-33110

Vulnerability Analysis

The vulnerability stems from unsafe deserialization of attacker-controlled data within Microsoft SharePoint Server. SharePoint exposes several server-side handlers that accept serialized .NET objects in request payloads. When the application deserializes this input without validating the expected type, a crafted gadget chain can drive method invocations that lead to arbitrary code execution under the SharePoint service account.

The attack vector is network-based and requires authentication with low privileges. A standard SharePoint user with the ability to reach a vulnerable endpoint is sufficient. No user interaction is needed. Once code execution is achieved, the attacker inherits the rights of the SharePoint application pool identity, which typically has broad access to content databases and farm configuration.

Microsoft tracks this issue under the CWE-502 classification for deserialization of untrusted data. The class of bug has a long history of exploitation in SharePoint, including chains involving ViewState, BinaryFormatter, and DataSet deserialization. Refer to the Microsoft CVE-2026-33110 Advisory for vendor-confirmed technical details.

Root Cause

The root cause is the use of an insecure deserializer on input received from authenticated HTTP requests. Type filtering or a SerializationBinder is either absent or insufficient, allowing dangerous types to be instantiated during object reconstruction.

Attack Vector

An authenticated attacker sends an HTTP request to a vulnerable SharePoint endpoint with a serialized payload containing a known gadget chain. SharePoint reconstructs the object graph and triggers code execution as the worker process identity, typically without writing a webshell to disk.

No verified public proof-of-concept code is available for CVE-2026-33110 at the time of writing. Defenders should consult Microsoft's advisory for indicators and apply the security update rather than rely on synthetic exploit code.

Detection Methods for CVE-2026-33110

Indicators of Compromise

• Unexpected child processes spawned by w3wp.exe running under the SharePoint application pool identity, such as cmd.exe, powershell.exe, or csc.exe.
• Outbound network connections from SharePoint servers to unknown external hosts following authenticated POST requests to SharePoint web services.
• New or modified files in SharePoint web application directories, including LAYOUTS, _app_bin, or App_Data.
• IIS log entries showing POST requests with abnormally large request bodies to endpoints that accept serialized content.

Detection Strategies

• Hunt for w3wp.exe parent-child process anomalies on SharePoint servers and correlate with authentication events for the originating session.
• Inspect IIS logs for unusual Content-Type headers such as application/x-www-form-urlencoded carrying base64-encoded .NET serialized payloads.
• Monitor Windows Event Logs for .NET runtime exceptions involving BinaryFormatter, LosFormatter, or ObjectStateFormatter on SharePoint hosts.
• Use file integrity monitoring on SharePoint hive directories and the GAC to identify unauthorized assembly drops.

Monitoring Recommendations

• Forward IIS, SharePoint ULS, and Windows Security logs to a centralized analytics platform for cross-correlation.
• Alert on authenticated low-privileged accounts accessing administrative or service endpoints they have no business reason to use.
• Track creation of scheduled tasks, services, or local accounts on SharePoint servers in near real time.

How to Mitigate CVE-2026-33110

Immediate Actions Required

• Apply the Microsoft security update for CVE-2026-33110 to all affected SharePoint Server Subscription Edition, 2019, and 2016 farms as referenced in the Microsoft CVE-2026-33110 Advisory.
• Audit SharePoint user accounts and remove unnecessary low-privileged access, particularly for accounts that can authenticate from outside the corporate network.
• Review SharePoint servers for signs of prior exploitation, focusing on w3wp.exe process trees and recent file changes.

Patch Information

Microsoft has issued a security update addressing the deserialization flaw across SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Administrators should install the update through standard patch management channels and run the SharePoint Products Configuration Wizard or PSConfig on each farm server after installation to complete deployment.

Workarounds

• Restrict network exposure of SharePoint web front ends to trusted networks and require VPN or Zero Trust Network Access for external users.
• Enforce multi-factor authentication on all SharePoint accounts to raise the cost of obtaining the low-privileged access required for exploitation.
• Place a web application firewall in front of SharePoint with rules that block known .NET deserialization gadget signatures until patches are deployed.
• Run the SharePoint application pool under a least-privileged service account with no local administrator rights on the server.