CVE-2026-66808: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-66808 Overview

CVE-2026-66808 is a deserialization of untrusted data vulnerability [CWE-502] in Microsoft Office SharePoint. An authenticated attacker with low-level privileges can execute arbitrary code over the network by submitting crafted serialized payloads that SharePoint deserializes without proper validation. The flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. Microsoft published the advisory through the Microsoft Security Response Center (MSRC) update guide.

Critical Impact
Authenticated attackers can achieve remote code execution on SharePoint servers, compromising confidentiality, integrity, and availability of collaboration data and enabling lateral movement across enterprise environments.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-08-11 - CVE-2026-66808 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-66808

Vulnerability Analysis

The vulnerability originates in SharePoint's handling of serialized .NET objects submitted through authenticated request paths. When SharePoint deserializes untrusted data without validating the type or content of the serialized stream, attacker-controlled gadget chains execute during object reconstruction. This class of flaw [CWE-502] has repeatedly affected SharePoint because of the platform's extensive use of BinaryFormatter, XML, and ViewState serialization across web parts, workflows, and API endpoints.

Exploitation requires the attacker to hold valid credentials with at least low-level SharePoint access. Once authenticated, the attacker submits a crafted payload to a vulnerable endpoint. Deserialization triggers a gadget chain that spawns arbitrary code in the context of the SharePoint application pool identity, typically a service account with broad access to farm resources.

The EPSS score of 1.58% places this vulnerability in the 73rd percentile of exploit likelihood, reflecting historical attacker interest in SharePoint deserialization flaws.

Root Cause

The root cause is unsafe deserialization of attacker-controlled input. SharePoint accepts serialized objects on authenticated code paths and reconstructs them without enforcing a type allow-list or cryptographic integrity check. Gadget classes present in the .NET runtime and SharePoint assemblies then execute code during deserialization callbacks such as OnDeserialization or type converters invoked by BinaryFormatter.

Attack Vector

The attack vector is network-based over HTTP or HTTPS to the SharePoint web front end. An attacker authenticated to SharePoint sends a POST request containing the serialized payload to a vulnerable handler. No user interaction is required, and the scope remains unchanged. The attacker requires only valid low-privilege credentials, which can be obtained through phishing, credential stuffing, or compromise of a low-tier account.

No public proof-of-concept exploit code is available at the time of publication. Refer to the Microsoft Security Update CVE-2026-66808 advisory for vendor-specific technical detail.

Detection Methods for CVE-2026-66808

Indicators of Compromise

Unexpected w3wp.exe child processes such as cmd.exe, powershell.exe, or certutil.exe originating from the SharePoint application pool.
New or modified .aspx files in SharePoint layouts, _layouts, or TEMPLATE directories consistent with webshell deployment.
Outbound network connections from SharePoint servers to unfamiliar external IP addresses following authenticated POST requests.
IIS log entries showing large or Base64-encoded POST bodies targeting SharePoint API or web part endpoints.

Detection Strategies

Monitor IIS logs for POST requests to SharePoint endpoints containing serialized object markers such as __VIEWSTATE anomalies or unusually large payloads from authenticated sessions.
Correlate authentication events with process creation on SharePoint front-end servers to identify credential-backed code execution.
Apply YARA and endpoint rules that flag known .NET deserialization gadget signatures in memory and on disk.

Monitoring Recommendations

Enable and forward SharePoint ULS, Windows Security, and IIS logs to a centralized SIEM for correlation.
Baseline normal application pool behavior and alert on deviations such as child process creation or LSASS access.
Track privileged account usage against SharePoint web services and flag authentication from unusual geolocations or user agents.

How to Mitigate CVE-2026-66808

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-66808 to all affected SharePoint Server instances.
Rotate SharePoint farm and machine keys after patching to invalidate any attacker-forged ViewState or serialized payloads.
Audit SharePoint accounts and remove or reduce privileges for accounts that do not require authenticated access.
Review SharePoint servers for signs of prior exploitation, including webshells and anomalous scheduled tasks.

Patch Information

Microsoft has released security updates for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. Administrators should install the cumulative update associated with the August 2026 security release and validate patch level using Get-SPProduct on each farm server. Full deployment guidance is available in the Microsoft Security Update CVE-2026-66808 advisory.

Workarounds

Restrict network access to SharePoint web front ends using firewall rules and reverse-proxy allow-lists where operationally feasible.
Enforce multi-factor authentication (MFA) on all SharePoint accounts to raise the barrier for the authenticated prerequisite.
Enable AMSI integration for SharePoint Server 2016 and later to allow antimalware inspection of deserialized content.
Isolate SharePoint servers on segmented network zones to limit lateral movement following any successful exploitation.

bash

# Verify SharePoint patch level on each farm server
Get-SPProduct -Local | Select-Object ProductName, PatchableUnitDisplayName, Patches

# Enable AMSI integration for SharePoint (SharePoint Server 2016+)
Set-SPSecurityTokenServiceConfig -AmsiEnabled $true

# Rotate the farm machine key after patching
Update-SPMachineKey -WebApplication https://sharepoint.example.com