CVE-2026-40357: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-40357 Overview

CVE-2026-40357 is a deserialization of untrusted data vulnerability [CWE-502] in Microsoft Office SharePoint. The flaw allows an authenticated attacker to execute arbitrary code over a network by sending crafted serialized payloads to a vulnerable SharePoint server. Successful exploitation results in code execution within the SharePoint application context, leading to compromise of confidentiality, integrity, and availability on the affected host.

The vulnerability affects supported releases of Microsoft SharePoint Server, including Subscription Edition, 2019, and 2016. Microsoft published guidance through the Microsoft Security Response Center (MSRC) on May 12, 2026.

Critical Impact

An authenticated attacker with low privileges can achieve remote code execution on SharePoint Server, potentially pivoting to broader enterprise resources hosted on the SharePoint farm.

Affected Products

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server 2016 (Enterprise)

Discovery Timeline

• 2026-05-12 - CVE-2026-40357 published to NVD
• 2026-05-12 - Microsoft releases security update via MSRC
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-40357

Vulnerability Analysis

The vulnerability stems from unsafe deserialization of attacker-controlled data within a Microsoft SharePoint Server component. SharePoint accepts serialized objects from authenticated users and reconstructs them without sufficient type validation. An attacker who can authenticate with low privileges can submit a crafted payload that triggers code execution during the deserialization process.

The CWE-502 weakness class covers cases where applications deserialize data from untrusted sources without verifying the resulting object graph. In .NET-based applications such as SharePoint, exploitable gadget chains in the BinaryFormatter, NetDataContractSerializer, or LosFormatter classes can be leveraged to invoke arbitrary methods. The EPSS score of 0.555% places exploitation probability in the 68th percentile across known CVEs.

Root Cause

The root cause is improper validation of serialized input before object reconstruction. SharePoint deserializes data structures that contain type information controlled by the request sender. When a malicious payload references a dangerous gadget type, the deserializer instantiates the object and triggers code paths that execute attacker-supplied commands under the w3wp.exe worker process identity.

Attack Vector

Exploitation requires network access to the SharePoint web application and valid authenticated credentials at any privilege level. The attacker submits a crafted HTTP request containing a serialized payload to a vulnerable SharePoint endpoint. No user interaction is required, and the attack complexity is low. Code executes in the context of the SharePoint application pool identity, providing access to SharePoint content databases and adjacent service accounts.

No public proof-of-concept exploit is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft CVE-2026-40357 Update for technical details.

Detection Methods for CVE-2026-40357

Indicators of Compromise

• Unexpected child processes of w3wp.exe such as cmd.exe, powershell.exe, or rundll32.exe on SharePoint Web Front End servers.
• Anomalous outbound network connections from SharePoint application pool identities to unfamiliar hosts.
• Unusual .aspx file creation in SharePoint layouts directories or temporary ASP.NET compilation folders.
• IIS log entries containing large or base64-encoded POST bodies to SharePoint handlers or web service endpoints.

Detection Strategies

• Monitor IIS request logs for oversized POST requests to SharePoint _vti_bin, _layouts, and ASMX endpoints with serialized content patterns.
• Inspect Windows Event Logs and Sysmon process creation events for SharePoint worker processes spawning interpreter or scripting binaries.
• Correlate authenticated SharePoint session activity with subsequent privilege escalation or lateral movement attempts on the host.

Monitoring Recommendations

• Enable verbose IIS logging and forward SharePoint ULS logs to a centralized SIEM for correlation across the farm.
• Apply behavioral detection rules to flag deserialization gadget signatures such as System.Windows.Markup.XamlReader or ObjectDataProvider references in HTTP bodies.
• Track changes to SharePoint configuration files, web.config entries, and the GAC for indicators of post-exploitation persistence.

How to Mitigate CVE-2026-40357

Immediate Actions Required

• Apply the security update published by Microsoft through the MSRC advisory to all SharePoint Server Subscription Edition, 2019, and 2016 deployments.
• Inventory all SharePoint farm members, including Web Front Ends and Application Servers, to ensure consistent patch coverage.
• Rotate machine keys and service account credentials after patching to invalidate any pre-existing attacker-staged payloads.

Patch Information

Microsoft has released cumulative security updates addressing CVE-2026-40357. Administrators should consult the Microsoft CVE-2026-40357 Update advisory for the specific KB articles and download links applicable to each supported SharePoint version. Apply the update through Windows Update, WSUS, or manual installation, then run the SharePoint Products Configuration Wizard to finalize the upgrade.

Workarounds

• Restrict SharePoint authentication to trusted internal users and enforce multi-factor authentication to raise the bar for low-privilege account compromise.
• Place SharePoint web applications behind a web application firewall configured to inspect and block serialized .NET payload signatures.
• Limit network exposure of SharePoint endpoints to required user populations using firewall rules or reverse proxy access policies.

# Verify SharePoint patch level after applying the update
Get-SPProduct -Local | Select-Object ProductName, PatchableUnitDisplayName, BuildVersion

# Confirm Configuration Wizard has completed on each farm server
Get-SPFarm | Select-Object BuildVersion, Status