CVE-2026-70321: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-70321 Overview

CVE-2026-70321 is a deserialization of untrusted data vulnerability [CWE-502] in Microsoft Office SharePoint. An authenticated attacker with low-level privileges can send a crafted serialized payload over the network to trigger arbitrary code execution on the SharePoint Server. The flaw affects Microsoft SharePoint Server (subscription edition) and impacts the confidentiality, integrity, and availability of the host. Microsoft published the advisory on August 11, 2026, and the vulnerability carries a CVSS 3.1 base score of 8.8. No public exploit code or in-the-wild exploitation has been reported at the time of publication.

Critical Impact
Authenticated attackers can achieve remote code execution on SharePoint servers, enabling full compromise of the SharePoint farm, lateral movement, and access to sensitive collaboration data.

Affected Products

Microsoft SharePoint Server (Subscription Edition)
SharePoint Server installations exposing web-facing endpoints to authenticated users
Environments where SharePoint deserializes user-supplied objects without integrity validation

Discovery Timeline

2026-08-11 - CVE-2026-70321 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-70321

Vulnerability Analysis

The vulnerability stems from insecure deserialization of untrusted data within Microsoft Office SharePoint Server. SharePoint processes serialized .NET objects submitted through network-accessible endpoints without adequately validating object types or content. When the server reconstructs these objects, gadget chains embedded in the payload can execute attacker-controlled code within the SharePoint worker process context.

Exploitation requires network access and valid authentication with low privileges (PR:L). No user interaction is required. Successful exploitation grants code execution under the SharePoint application pool identity, which typically has broad access to content databases, service accounts, and connected systems.

The EPSS probability is 1.254% at the 66.8th percentile, indicating moderate near-term exploitation likelihood relative to other published CVEs. Because SharePoint frequently serves as a central collaboration hub, compromise can expose intellectual property, credentials cached in configuration stores, and search indexes covering large portions of the enterprise.

Root Cause

The root cause is unsafe deserialization [CWE-502] of attacker-controlled input. SharePoint accepts serialized data from authenticated requests and reconstructs .NET objects without a strict type allow-list or cryptographic integrity check. This allows an attacker to smuggle gadget chains that invoke dangerous methods during object reconstruction.

Attack Vector

The attack vector is network-based (AV:N) with low attack complexity (AC:L). An attacker authenticates to SharePoint using any valid low-privilege account, then submits a crafted serialized payload to a vulnerable endpoint. During deserialization, the payload triggers method calls that lead to arbitrary command execution. Full technical details are restricted to the Microsoft Security Update CVE-2026-70321 advisory. No public proof-of-concept is available at the time of writing.

Detection Methods for CVE-2026-70321

Indicators of Compromise

Unexpected child processes spawned from w3wp.exe running under the SharePoint application pool identity, such as cmd.exe, powershell.exe, or rundll32.exe.
Anomalous outbound network connections initiated by the SharePoint worker process to external hosts.
SharePoint ULS logs containing deserialization exceptions, type-load failures, or BinaryFormatter errors correlated with authenticated requests.
New or modified files under the SharePoint LAYOUTS, bin, or _app_bin directories that were not part of a sanctioned deployment.

Detection Strategies

Alert on process lineage where w3wp.exe hosting a SharePoint application pool spawns interactive shells or scripting engines.
Inspect IIS request logs for unusually large POST bodies to SharePoint endpoints handling serialized state or view data.
Correlate authentication events with subsequent code-execution behaviors on the same host to identify low-privilege accounts abused for exploitation.

Monitoring Recommendations

Forward SharePoint ULS logs, IIS logs, and Windows Security event logs to a centralized SIEM for correlation.
Baseline normal SharePoint worker-process behavior and alert on deviations in child processes, loaded modules, and outbound traffic.
Monitor privileged account usage on SharePoint servers and flag lateral movement attempts originating from the SharePoint host.

How to Mitigate CVE-2026-70321

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-70321 advisory to all SharePoint Server (Subscription Edition) instances.
Inventory all SharePoint farms and confirm patch status across web front-ends, application servers, and search roles.
Rotate credentials and service account secrets stored in or accessible to SharePoint if compromise is suspected.
Restrict network access to SharePoint endpoints so that only required user populations can authenticate.

Patch Information

Microsoft has issued fixed builds for SharePoint Server Subscription Edition. Refer to the Microsoft Security Update CVE-2026-70321 guidance for the exact package identifiers, prerequisite updates, and post-installation configuration steps such as running the SharePoint Products Configuration Wizard on each server in the farm.

Workarounds

Reduce the authenticated user population that can reach SharePoint endpoints by enforcing conditional access and network segmentation.
Require multi-factor authentication for all SharePoint access to raise the cost of using stolen low-privilege credentials.
Enable and enforce Antimalware Scan Interface (AMSI) integration on SharePoint servers where supported to inspect deserialized payload execution.
Monitor the SharePoint application pool identity closely until patching is complete, and consider temporarily blocking non-essential custom serialization endpoints.

bash

# Verify SharePoint patch level on each server in the farm
Get-SPFarm | Select-Object BuildVersion
Get-SPProduct -Local | Select-Object ProductName, PatchableUnitDisplayName, Patches