CVE-2026-45484: SharePoint Privilege Escalation Vulnerability

CVE-2026-45484 Overview

CVE-2026-45484 is a deserialization of untrusted data vulnerability [CWE-502] in Microsoft Office SharePoint. An authorized attacker can exploit this flaw over a network to elevate privileges on the affected server. The vulnerability carries a CVSS v3.1 score of 8.8 and requires low privileges with no user interaction. Successful exploitation impacts confidentiality, integrity, and availability of the SharePoint environment.

Critical Impact
An authenticated attacker can elevate privileges across a SharePoint deployment by sending crafted serialized payloads, enabling lateral movement and potential takeover of collaboration infrastructure.

Affected Products

Microsoft Office SharePoint (versions identified in the Microsoft Security Response Center advisory)
SharePoint Server deployments processing serialized objects from authenticated users
SharePoint environments exposed to internal network access by low-privileged accounts

Discovery Timeline

2026-06-09 - CVE-2026-45484 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45484

Vulnerability Analysis

The vulnerability resides in SharePoint's handling of serialized data submitted by authenticated users. SharePoint accepts serialized objects without enforcing strict type controls or integrity validation before reconstruction. When the server deserializes attacker-controlled data, it instantiates objects and invokes methods defined within the payload. This behavior provides a path for an authenticated attacker to execute code in the context of the SharePoint application identity, resulting in privilege elevation.

The weakness is classified under [CWE-502] Deserialization of Untrusted Data. The EPSS probability of 0.682% places it in the 72nd percentile for likelihood of exploitation activity. Privilege elevation in SharePoint is consequential because the platform typically holds sensitive documents, integrates with Active Directory, and operates with elevated service accounts.

Root Cause

The root cause is the use of unsafe deserialization routines that reconstruct .NET objects from user-supplied input without validating type allow-lists or applying signed payload checks. Gadget chains available within loaded assemblies enable attacker-controlled method invocation during object graph reconstruction.

Attack Vector

The attack vector is network-based and requires the attacker to hold valid SharePoint credentials at any authenticated role. The attacker submits a malicious serialized payload through a SharePoint endpoint that processes serialized objects. Upon deserialization, the payload triggers gadget chains that execute code or modify privileged objects, elevating the attacker's effective permissions on the server.

No public proof-of-concept code is referenced in the advisory. See the Microsoft Security Update CVE-2026-45484 advisory for technical details and affected build numbers.

Detection Methods for CVE-2026-45484

Indicators of Compromise

Unexpected w3wp.exe child processes spawned from SharePoint application pools, particularly cmd.exe, powershell.exe, or rundll32.exe
Anomalous serialized payloads in SharePoint HTTP request bodies containing __type, BinaryFormatter, or ObjectStateFormatter markers
New or modified .aspx files written to SharePoint web application directories such as LAYOUTS or _vti_bin
Authentication events showing low-privileged accounts performing administrative SharePoint actions shortly after request bursts

Detection Strategies

Inspect SharePoint Unified Logging Service (ULS) logs for deserialization exceptions and stack traces referencing BinaryFormatter, LosFormatter, or ObjectStateFormatter
Correlate IIS request logs with process creation events on SharePoint servers to surface code execution following POST requests to serialization-handling endpoints
Build behavioral rules that flag SharePoint service accounts launching shells, executing encoded commands, or writing executables to disk
Monitor Active Directory for unexpected privilege changes initiated by SharePoint service identities

Monitoring Recommendations

Forward IIS, ULS, and Windows Security event logs from all SharePoint front-end and application servers to a centralized analytics platform
Enable PowerShell script block logging and Sysmon process creation events on SharePoint hosts
Alert on outbound network connections initiated by SharePoint worker processes to non-corporate destinations
Review authentication telemetry for SharePoint accounts performing actions outside their normal role baseline

How to Mitigate CVE-2026-45484

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-45484 advisory to all SharePoint servers
Inventory SharePoint servers, including non-production and disaster recovery instances, to ensure complete patch coverage
Rotate machine keys, service account credentials, and any secrets accessible to SharePoint application pools after patching
Restrict SharePoint authentication to trusted networks and enforce multi-factor authentication for all SharePoint users

Patch Information

Microsoft has released a security update through the Microsoft Security Response Center. Administrators should consult the Microsoft Security Update CVE-2026-45484 advisory for the exact cumulative update numbers that correspond to each supported SharePoint Server version. Apply the update through Windows Update, WSUS, or the Microsoft Update Catalog and follow Microsoft's post-installation guidance for SharePoint configuration database upgrades.

Workarounds

Limit SharePoint access to authenticated users on segmented network zones until patches are deployed
Remove or disable unused SharePoint web parts, custom serialization handlers, and legacy authentication providers
Run SharePoint application pools under least-privilege service accounts that lack domain administrative rights
Enable web application firewall rules that inspect request bodies for known .NET deserialization gadget signatures

bash

# Configuration example - verify SharePoint patch level on Windows Server
Get-SPProduct -Local | Select-Object ProductName, PatchableUnitDisplayName, PatchVersion
Get-HotFix | Where-Object { $_.Description -match 'Security Update' } | Sort-Object InstalledOn -Descending