CVE-2026-65663: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-65663 Overview

CVE-2026-65663 is a deserialization of untrusted data vulnerability [CWE-502] in Microsoft Office SharePoint. An authorized attacker can execute code over a network by submitting crafted serialized objects that SharePoint processes without adequate validation. The flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. Microsoft published the advisory on August 11, 2026, and updated it on August 13, 2026.

Critical Impact
Authenticated attackers can achieve remote code execution on SharePoint Server, gaining full compromise of the SharePoint farm and access to hosted documents, credentials, and downstream services.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-08-11 - CVE-2026-65663 published to NVD and Microsoft Security Response Center advisory released
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-65663

Vulnerability Analysis

CVE-2026-65663 stems from insecure deserialization within Microsoft Office SharePoint Server. SharePoint processes serialized .NET objects supplied by authenticated users without applying safe type restrictions. An attacker with valid SharePoint credentials can send crafted payloads that trigger gadget chains during deserialization. Successful exploitation runs attacker-controlled code in the context of the SharePoint web application pool, typically a service account with high privilege on the server.

The network attack vector and low attack complexity mean any authenticated user session, including low-privilege accounts, can be sufficient. Because the impact spans confidentiality, integrity, and availability, code execution enables data theft, tampering with SharePoint content, lateral movement, and persistence. SharePoint farms often store credentials, secrets, and business documents, expanding the blast radius across the enterprise.

Root Cause

The root cause is unsafe handling of serialized input, classified under CWE-502 (Deserialization of Untrusted Data). SharePoint reconstructs objects from user-supplied streams without binding to an allowlist of expected types. This lets attackers instantiate arbitrary types that trigger side effects during construction or property setting, ending in arbitrary command execution.

Attack Vector

Exploitation requires network access to SharePoint web endpoints and valid credentials. The attacker authenticates, then submits a crafted request containing a serialized payload to a vulnerable SharePoint handler. During deserialization, a gadget chain executes attacker-controlled commands under the SharePoint application pool identity. No user interaction is required beyond the attacker's own authenticated session.

No public proof-of-concept exploit or CISA KEV listing exists for CVE-2026-65663 at the time of publication. The EPSS score is 1.147%, placing this vulnerability in the 63rd percentile of exploit likelihood.

No verified public exploit code is available. Refer to the Microsoft Security Update Advisory for technical details as Microsoft releases additional information.

Detection Methods for CVE-2026-65663

Indicators of Compromise

Unusual w3wp.exe child processes spawning cmd.exe, powershell.exe, or mshta.exe from SharePoint application pools
Anomalous outbound network connections originating from SharePoint front-end servers to unknown hosts
New ASPX files, web shells, or unexpected assemblies written to SharePoint LAYOUTS or _layouts directories
SharePoint ULS logs showing deserialization errors or type-load exceptions from unfamiliar request URIs

Detection Strategies

Hunt for POST requests to SharePoint endpoints containing base64 or binary serialized __VIEWSTATE, t:SerializedObject, or BinaryFormatter markers from low-privilege accounts
Alert on process lineage where w3wp.exe spawns scripting interpreters or LOLBins on SharePoint hosts
Correlate authenticated SharePoint sessions with subsequent file writes to web-accessible directories

Monitoring Recommendations

Enable IIS request logging and forward SharePoint ULS logs to a central SIEM for retention and correlation
Baseline normal SharePoint service account behavior and alert on deviations such as new outbound protocols or unusual command execution
Monitor Windows Event ID 4688 for process creation events on SharePoint servers with parent process w3wp.exe

How to Mitigate CVE-2026-65663

Immediate Actions Required

Apply the August 2026 Microsoft security updates for SharePoint Server Subscription Edition, 2019, and 2016 as documented in the Microsoft Security Update Advisory
Audit SharePoint accounts and enforce least privilege, removing unnecessary contributor and site collection administrator permissions
Rotate SharePoint farm service account credentials and machine keys if compromise is suspected
Review recent SharePoint logs and file system changes for indicators of prior exploitation

Patch Information

Microsoft has released security updates addressing CVE-2026-65663 for all supported SharePoint Server versions. Administrators should install the updates through Windows Update, WSUS, or the Microsoft Update Catalog and follow the SharePoint post-patch configuration steps described in the Microsoft Security Update Advisory. SharePoint patches require running the SharePoint Products Configuration Wizard on each server in the farm.

Workarounds

Restrict SharePoint access to trusted network segments using firewall rules and VPN gating until patches are deployed
Enforce multi-factor authentication on all SharePoint accounts to raise the bar for credential-based access
Disable or restrict SharePoint features that accept serialized input from end users where feasible in your environment

bash

# Verify SharePoint patch level after installing the update
Get-SPProduct | Select-Object ProductName, PatchableUnitDisplayName, Version

# Run the SharePoint Products Configuration Wizard from PowerShell
psconfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures