CVE-2026-47294: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-47294 Overview

CVE-2026-47294 is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint Server. An authorized attacker can execute arbitrary code over a network by submitting crafted serialized payloads to the affected SharePoint instance. The flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. Microsoft tracks the issue under [CWE-78] and rates it HIGH with a CVSS 3.1 base score of 8.0. Exploitation requires low privileges and user interaction, but successful attacks yield full impact to confidentiality, integrity, and availability. No public exploit code or in-the-wild activity has been reported at publication time.

Critical Impact

An authenticated attacker can achieve remote code execution on SharePoint Server, leading to full compromise of the SharePoint farm and exposed enterprise content.

Affected Products

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

• 2026-06-01 - CVE-2026-47294 published to the National Vulnerability Database
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-47294

Vulnerability Analysis

The vulnerability resides in SharePoint Server code paths that deserialize attacker-controlled data without sufficient type validation. When SharePoint reconstructs objects from a serialized stream, gadget chains within trusted .NET assemblies can be triggered during the deserialization process. The reconstructed object graph causes the server worker process to execute attacker-defined methods. Because the SharePoint application pool typically runs with elevated service account privileges, the executed code inherits broad access to site collections, configuration databases, and adjacent services.

Root Cause

The root cause is unsafe handling of serialized input where the deserializer accepts arbitrary object types instead of constraining input to an allowlist. This pattern aligns with classic .NET insecure deserialization issues such as BinaryFormatter, LosFormatter, or ObjectStateFormatter accepting untrusted payloads. The MITRE classification of [CWE-78] reflects the downstream effect of command execution achieved through the deserialization gadget chain.

Attack Vector

An attacker authenticated to SharePoint with low privileges submits a malicious serialized payload over the network. The CVSS vector indicates user interaction is required, suggesting the attack chain involves a victim opening a crafted link, document, or page that triggers server-side deserialization. Successful exploitation results in code execution under the SharePoint service identity, enabling lateral movement, credential theft, and persistence within the SharePoint farm.

No verified proof-of-concept code is publicly available. See the Microsoft Security Update Guide for vendor-supplied technical context.

Detection Methods for CVE-2026-47294

Indicators of Compromise

• Unexpected child processes spawned by the SharePoint application pool worker (w3wp.exe), particularly cmd.exe, powershell.exe, or csc.exe.
• Outbound network connections from SharePoint front-end servers to unfamiliar hosts following authenticated POST requests.
• New or modified .aspx, .ashx, or .asmx files in SharePoint LAYOUTS, _vti_bin, or web application directories.
• IIS logs showing crafted POST requests with abnormally large base64 or binary-encoded body content targeting SharePoint endpoints.

Detection Strategies

• Hunt for w3wp.exe process trees that deviate from baseline behavior on SharePoint hosts, especially shell or scripting engine descendants.
• Inspect Windows Event Logs for SharePoint service account logons followed by command-line activity inconsistent with administrative operations.
• Correlate authenticated SharePoint sessions with anomalous server-side process creation timestamps.

Monitoring Recommendations

• Enable Microsoft Antimalware Scan Interface (AMSI) integration on SharePoint Servers to inspect dynamic script execution.
• Forward IIS, SharePoint ULS, and Windows Security logs to a centralized SIEM for correlation and retention.
• Monitor service account behavior on SharePoint farms and alert on first-time process creations or outbound connections.

How to Mitigate CVE-2026-47294

Immediate Actions Required

• Apply the Microsoft security updates referenced in the Microsoft Security Update Guide for each affected SharePoint version.
• Inventory all SharePoint Server 2016, 2019, and Subscription Edition instances and prioritize internet-exposed farms for immediate patching.
• Rotate SharePoint farm, service, and application pool account credentials after patching, especially if compromise is suspected.
• Restrict SharePoint access to authenticated users behind reverse proxies or VPN where feasible to limit attacker reachability.

Patch Information

Microsoft has released security updates addressing CVE-2026-47294 for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Administrators should review the Microsoft Security Update Guide for the specific KB articles and cumulative update packages applicable to their deployment.

Workarounds

• Enforce least-privilege configuration for SharePoint application pool and farm accounts to reduce blast radius if exploitation occurs.
• Disable or restrict SharePoint features and custom solutions that accept serialized input from low-privileged users until patches are applied.
• Deploy a Web Application Firewall (WAF) rule set to inspect and block suspicious serialized payloads targeting SharePoint endpoints.
• Require multi-factor authentication for all SharePoint users to raise the cost of obtaining the low-privilege foothold the attacker needs.