CVE-2026-66805: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-66805 Overview

CVE-2026-66805 is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint. The flaw allows an authenticated attacker with low privileges to execute arbitrary code on the SharePoint server over a network. Microsoft published the advisory on 2026-08-11, and the issue affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. The vulnerability maps to [CWE-502] Deserialization of Untrusted Data.

Critical Impact
An authorized attacker can achieve remote code execution on SharePoint servers, compromising confidentiality, integrity, and availability of collaboration content and downstream enterprise resources.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-08-11 - CVE-2026-66805 published to the National Vulnerability Database
2026-08-11 - Microsoft released security update for CVE-2026-66805
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-66805

Vulnerability Analysis

The vulnerability stems from SharePoint deserializing attacker-controlled data without validating the object graph. When an authenticated user submits a crafted serialized payload, the server reconstructs .NET objects and invokes gadget chains during deserialization. This results in arbitrary code execution in the context of the SharePoint application pool identity.

The attacker must hold valid credentials to reach the affected endpoint. Once authenticated, exploitation does not require user interaction and can be performed over the network. Successful exploitation grants code execution equivalent to the SharePoint worker process, which typically has broad access to configuration databases and content stores.

EPSS scoring places this issue in the 73rd percentile, indicating measurable exploitation likelihood relative to the broader CVE population. No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication.

Root Cause

SharePoint accepts serialized .NET objects on server-side endpoints and instantiates them without enforcing a strict type allowlist. Attacker-supplied gadget chains, such as those historically abused through BinaryFormatter or LosFormatter, trigger arbitrary method invocation during object reconstruction. This is a canonical [CWE-502] pattern in enterprise .NET applications.

Attack Vector

An attacker authenticates to SharePoint using any valid low-privileged account. The attacker then sends a crafted request containing a malicious serialized payload to a vulnerable server-side handler. The SharePoint process deserializes the payload, executes the embedded gadget chain, and runs arbitrary code as the application pool account. From that foothold, the attacker can pivot to farm credentials, content databases, and connected services.

Refer to the Microsoft Security Update CVE-2026-66805 advisory for technical details specific to the affected endpoints.

Detection Methods for CVE-2026-66805

Indicators of Compromise

Unexpected child processes spawned by w3wp.exe associated with SharePoint application pools, particularly cmd.exe, powershell.exe, or script interpreters.
Anomalous outbound network connections from SharePoint servers to untrusted hosts following authenticated POST requests.
New or modified .aspx files in SharePoint layout, template, or _layouts directories written by the SharePoint worker process.
IIS log entries showing authenticated requests with large binary or base64 payloads to SharePoint handler endpoints.

Detection Strategies

Hunt for w3wp.exe process trees launching command shells or reflective loaders, a strong signal of deserialization gadget execution.
Monitor .NET runtime telemetry for BinaryFormatter, LosFormatter, NetDataContractSerializer, or ObjectStateFormatter invocations tied to inbound HTTP requests.
Correlate authentication events with rapid follow-on POST requests carrying serialized content types to identify credentialed exploitation attempts.

Monitoring Recommendations

Ingest IIS, Windows Security, and Sysmon logs from SharePoint servers into a centralized SIEM for correlation and long-term retention.
Enable PowerShell script block logging and .NET ETW providers on SharePoint hosts to capture in-process execution artifacts.
Alert on service account activity that deviates from established baselines, especially interactive logons or lateral movement from SharePoint hosts.

How to Mitigate CVE-2026-66805

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-66805 to SharePoint Server Subscription Edition, 2019, and 2016 without delay.
Inventory all SharePoint farms, including test and disaster recovery environments, and confirm patch deployment across every server.
Rotate machine keys and service account credentials on affected farms if compromise is suspected, since deserialization exploits often expose secrets.
Restrict SharePoint account privileges and enforce multi-factor authentication to limit the pool of accounts an attacker can weaponize.

Patch Information

Microsoft published the fix in the August 2026 Patch Tuesday cycle. Administrators should reference the Microsoft Security Update CVE-2026-66805 guide for build numbers, KB article identifiers, and any prerequisite updates specific to each supported SharePoint version.

Workarounds

Limit network exposure of SharePoint servers by restricting access to trusted networks and VPN segments while patch deployment is scheduled.
Enforce Web Application Firewall rules that inspect and block requests containing serialized .NET payload signatures targeting SharePoint handlers.
Audit and reduce the number of accounts with authenticated access to SharePoint to shrink the attack surface for authorized-attacker vulnerabilities.

bash

# Verify installed SharePoint updates on a server
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 20

# Confirm SharePoint farm build after patching
(Get-SPFarm).BuildVersion