CVE-2026-64901: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-64901 Overview

CVE-2026-64901 is a deserialization of untrusted data vulnerability [CWE-502] in Microsoft Office SharePoint Server. An authenticated attacker with network access can execute arbitrary code on affected SharePoint servers by submitting crafted serialized objects. The flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. Microsoft published the advisory on August 11, 2026, and the vulnerability carries a CVSS 3.1 base score of 8.8. Successful exploitation compromises the confidentiality, integrity, and availability of the SharePoint farm, giving the attacker the ability to run code in the context of the SharePoint application pool identity.

Critical Impact
An authenticated network attacker can achieve remote code execution on SharePoint servers, with potential lateral movement across the entire collaboration environment.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-08-11 - CVE-2026-64901 published to NVD
2026-08-11 - Microsoft releases security advisory and patch guidance
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-64901

Vulnerability Analysis

The vulnerability stems from insecure deserialization of untrusted data inside a SharePoint Server component. SharePoint accepts serialized .NET objects from authenticated users and reconstructs them without validating the object graph or restricting allowed types. An attacker who holds a valid SharePoint account can submit a crafted payload that triggers a gadget chain during deserialization. The chain executes attacker-controlled code in the SharePoint worker process. Because SharePoint services typically run with elevated service account privileges, the attacker gains code execution with those privileges. The Exploit Prediction Scoring System places this CVE in a higher-than-average exploitation likelihood band, consistent with historical exploitation patterns for SharePoint deserialization flaws.

Root Cause

The root cause is the absence of a strict type allowlist and integrity binding during deserialization of user-supplied payloads. SharePoint reconstructs .NET objects from serialized input without a SerializationBinder that restricts types to a known-safe set. This design permits arbitrary gadget chains present in loaded assemblies to be instantiated and invoked, converting a data parsing operation into arbitrary code execution.

Attack Vector

Exploitation occurs over the network against a SharePoint web endpoint. The attacker must first authenticate to SharePoint with any valid low-privileged account. Once authenticated, the attacker submits a crafted request containing a malicious serialized payload to a vulnerable handler. The server deserializes the payload, triggering the gadget chain and executing commands as the SharePoint service identity. No user interaction is required. See the Microsoft CVE-2026-64901 Advisory for the specific components and endpoints referenced by Microsoft.

Detection Methods for CVE-2026-64901

Indicators of Compromise

Unexpected child processes spawned by w3wp.exe running under a SharePoint application pool identity, particularly cmd.exe, powershell.exe, or csc.exe.
New or modified .aspx, .ashx, or DLL files under SharePoint hive directories such as TEMPLATE\LAYOUTS that were not deployed by an administrator.
Anomalous outbound network connections from SharePoint servers to unfamiliar external hosts shortly after authenticated POST requests to SharePoint endpoints.

Detection Strategies

Alert on process creation events where the parent is w3wp.exe bound to a SharePoint application pool and the child is a shell, scripting, or compiler binary.
Inspect IIS logs for authenticated POST requests to SharePoint handlers containing unusually large payloads or Base64-encoded serialized markers such as AAEAAAD in request bodies.
Monitor .NET runtime telemetry for deserialization exceptions and for the loading of assemblies not signed by Microsoft into SharePoint worker processes.

Monitoring Recommendations

Forward SharePoint ULS logs, IIS logs, and Windows Security and Sysmon event streams to a centralized analytics platform for correlation.
Baseline normal command-line behavior of w3wp.exe per SharePoint server and alert on deviations.
Review authentication logs for accounts issuing high volumes of requests to SharePoint API and web service endpoints after the patch release date.

How to Mitigate CVE-2026-64901

Immediate Actions Required

Apply the security updates listed on the Microsoft CVE-2026-64901 Advisory to all SharePoint Server Subscription Edition, 2019, and 2016 Enterprise instances.
Rotate the SharePoint farm account and machine keys after patching to invalidate credentials that may have been captured by an attacker.
Audit SharePoint user accounts and remove or disable dormant accounts that could be leveraged as the required authenticated foothold.

Patch Information

Microsoft addressed CVE-2026-64901 in the August 2026 security update cycle. Administrators must install the specific cumulative update package for each SharePoint version listed in the Microsoft advisory. Cumulative updates for SharePoint require running the SharePoint Products Configuration Wizard or PSConfig.exe after installation to complete database and farm upgrade steps.

Workarounds

Restrict network access to SharePoint web front ends to trusted corporate ranges and VPN segments until patches are deployed.
Enforce strong authentication policies including multi-factor authentication to reduce the pool of accounts an attacker can abuse for the authenticated precondition.
Where feasible, place SharePoint behind a web application firewall configured to inspect and block serialized .NET payload markers in request bodies.

bash

# Verify installed SharePoint patch level after applying the August 2026 update
Get-SPFarm | Select-Object BuildVersion
Get-SPProduct -Local | Select-Object ProductName, PatchableUnitDisplayName, BuildVersion