CVE-2026-65658: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-65658 Overview

CVE-2026-65658 is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint. An authorized attacker can execute arbitrary code over a network by sending crafted serialized payloads to a vulnerable SharePoint server. The flaw is tracked under CWE-502 and affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Microsoft published the advisory through the Microsoft Security Response Center.

Critical Impact
An authenticated attacker with low privileges can achieve remote code execution on affected SharePoint servers, compromising confidentiality, integrity, and availability of hosted content and downstream services.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-08-11 - CVE-2026-65658 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-65658

Vulnerability Analysis

CVE-2026-65658 is an insecure deserialization flaw in Microsoft Office SharePoint. SharePoint processes serialized objects submitted through authenticated network requests without adequate type validation. An attacker who supplies a crafted serialized payload can trigger the instantiation of dangerous .NET gadget chains during deserialization. The result is arbitrary code execution in the context of the SharePoint application pool identity. Because SharePoint often runs with broad permissions across content databases and integrated services, successful exploitation typically leads to full server compromise and lateral movement into adjacent Microsoft 365 and Active Directory resources. The Exploit Prediction Scoring System places this issue in the 63rd percentile, reflecting a moderate near-term likelihood of exploitation activity following patch release.

Root Cause

The vulnerability originates from unsafe handling of serialized data within SharePoint request-processing components. SharePoint reconstructs .NET objects from attacker-controlled input without enforcing a strict type allowlist. This behavior falls under CWE-502: Deserialization of Untrusted Data. Known .NET gadget chains, such as those built on TypeConfuseDelegate or ObjectDataProvider, can be repurposed to reach code execution primitives during object reconstruction.

Attack Vector

Exploitation requires network access to the SharePoint server and valid authenticated credentials with at least low privileges. The attacker submits a serialized payload to a vulnerable endpoint that accepts and deserializes user-supplied content. No user interaction is required. Because many enterprises expose SharePoint to authenticated remote users through VPN, federated identity, or reverse proxies, the practical attack surface is broad. Technical details are available in the Microsoft Security Update advisory for CVE-2026-65658.

Detection Methods for CVE-2026-65658

Indicators of Compromise

Unexpected child processes spawned by w3wp.exe running under the SharePoint application pool identity, including cmd.exe, powershell.exe, or rundll32.exe.
New or modified .aspx files under SharePoint web application directories such as C:\inetpub\wwwroot\wss\VirtualDirectories\ indicating webshell deployment.
IIS request logs showing POST requests with unusually large serialized payloads to SharePoint endpoints from authenticated users.
Outbound network connections from SharePoint servers to unfamiliar external hosts shortly after suspicious POST activity.

Detection Strategies

Hunt for process-chain anomalies where w3wp.exe spawns interactive shells or scripting engines, a pattern uncommon in normal SharePoint operations.
Alert on creation of executable content within SharePoint layouts and virtual directory paths.
Correlate authenticated SharePoint sessions with subsequent process execution and file writes on the host.

Monitoring Recommendations

Enable IIS request body logging on SharePoint front-end servers to capture serialized payloads for retrospective analysis.
Forward Windows Security, Sysmon, and IIS logs to a centralized data lake for correlation and long-term retention.
Baseline expected SharePoint service account behavior and alert on deviations such as new outbound connections or credential access attempts.

How to Mitigate CVE-2026-65658

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-65658 to all affected SharePoint Server instances.
Inventory SharePoint Server 2016, 2019, and Subscription Edition deployments and prioritize internet-exposed and multi-tenant farms for immediate patching.
Rotate machine keys and service account credentials on any SharePoint server suspected of exposure prior to patch deployment.
Review authentication logs for anomalous low-privilege account activity that could indicate pre-positioning by an attacker.

Patch Information

Microsoft has released security updates for affected SharePoint Server versions. Refer to the Microsoft Security Update Guide entry for CVE-2026-65658 for build numbers, KB identifiers, and installation guidance specific to each supported edition.

Workarounds

Restrict SharePoint access to trusted network ranges using firewall rules or reverse proxy allowlists until patching is complete.
Enforce multi-factor authentication on all SharePoint user accounts to reduce the pool of credentials available for authenticated exploitation.
Remove or downgrade unnecessary contributor and higher privileges from accounts that do not require them.
Isolate SharePoint servers from tier-0 assets and Active Directory domain controllers at the network layer.

bash

# Example: block external access to SharePoint web endpoints at the perimeter
# Adjust interface and source ranges to match your environment
New-NetFirewallRule -DisplayName "Block-External-SharePoint" \
  -Direction Inbound \
  -Action Block \
  -Protocol TCP \
  -LocalPort 80,443 \
  -RemoteAddress Internet