CVE-2026-85900: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-85900 Overview

CVE-2026-85900 is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint. An authenticated attacker can send a crafted serialized payload across the network and execute arbitrary code on the SharePoint Server. The flaw is tracked under CWE-502: Deserialization of Untrusted Data and affects Microsoft SharePoint Server subscription edition.

Microsoft published guidance through the Microsoft Security Response Center. The vulnerability requires low privileges and no user interaction, which lowers the barrier for exploitation in environments where SharePoint credentials are widely issued.

Critical Impact
An authenticated attacker who exploits CVE-2026-85900 gains code execution on the SharePoint Server, enabling full compromise of hosted content, service accounts, and connected enterprise data.

Affected Products

Microsoft SharePoint Server (subscription edition)
SharePoint Server deployments exposing authenticated endpoints to internal networks
Hybrid SharePoint environments with federated authentication to on-premises servers

Discovery Timeline

2026-10-13 - CVE-2026-85900 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-85900

Vulnerability Analysis

CVE-2026-85900 stems from unsafe deserialization of attacker-controlled data within Microsoft SharePoint Server. SharePoint processes serialized objects from authenticated requests without sufficient type validation. When a crafted payload is deserialized, embedded gadget chains execute code in the context of the SharePoint worker process.

Successful exploitation yields high impact to confidentiality, integrity, and availability. The attacker runs code with the privileges of the SharePoint application pool identity. That identity typically has broad access to site collections, content databases, and service account tokens.

Microsoft classifies the issue as network-exploitable with low attack complexity. The EPSS model estimates a 1.518% probability of exploitation in the next 30 days, placing it in the 74th percentile of all scored CVEs.

Root Cause

The root cause is improper handling of serialized .NET objects passed to SharePoint endpoints. The deserializer instantiates types without a strict allow-list, which permits gadget chains that chain property setters and method invocations into arbitrary command execution. This pattern maps to CWE-502.

Attack Vector

The attack originates over the network against a SharePoint endpoint that accepts serialized input. The attacker must hold valid credentials with low privileges on the target SharePoint deployment. After authenticating, the attacker submits a crafted serialized blob to a vulnerable handler. The server deserializes the payload and executes the embedded gadget chain, resulting in code execution on the host.

Microsoft has not released public exploit details. Refer to the Microsoft Security Update for CVE-2026-85900 for vendor technical details.

Detection Methods for CVE-2026-85900

Indicators of Compromise

Unexpected child processes spawned by w3wp.exe running under the SharePoint application pool identity, such as cmd.exe, powershell.exe, or rundll32.exe.
IIS logs showing authenticated POST requests to SharePoint handlers with abnormally large or Base64-encoded body payloads.
New files written to SharePoint web directories, _LAYOUTS, or temporary ASP.NET compilation paths outside normal change windows.
Outbound network connections from SharePoint servers to unfamiliar external hosts following authenticated requests.

Detection Strategies

Baseline process ancestry for SharePoint worker processes and alert on any deviation that launches scripting or LOLBin binaries.
Inspect SharePoint and IIS logs for serialized object markers in request bodies, such as __type, TypeObject, or BinaryFormatter indicators.
Correlate authenticated SharePoint sessions with subsequent host-level process creation events to identify post-authentication code execution.

Monitoring Recommendations

Forward IIS, SharePoint ULS, Windows Security, and Sysmon logs to a centralized analytics platform for cross-source correlation.
Monitor SharePoint service account activity for lateral movement toward content databases and domain controllers.
Alert on configuration changes to SharePoint web.config, machine keys, and GAC assemblies that could indicate persistence.

How to Mitigate CVE-2026-85900

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-85900 on all SharePoint Server subscription edition hosts.
Rotate SharePoint machine keys, service account passwords, and ASP.NET validation keys after patching to invalidate any pre-existing forged payloads.
Audit SharePoint user and service accounts, removing accounts that are inactive or that hold privileges beyond business need.
Restrict SharePoint endpoints to trusted network segments and enforce multi-factor authentication for all SharePoint access.

Patch Information

Microsoft released a security update tracked at the Microsoft Security Update Guide for CVE-2026-85900. Administrators should apply the update to Microsoft SharePoint Server subscription edition through standard patch management channels and validate installation through SharePoint Central Administration.

Workarounds

Limit SharePoint access to authenticated users within controlled network zones using firewall or reverse proxy rules until the patch is deployed.
Enforce least privilege on the SharePoint application pool identity to reduce the impact of post-exploitation code execution.
Enable Windows Defender Application Control or AppLocker policies that block script interpreters from executing under w3wp.exe.
Increase logging verbosity on SharePoint ULS and IIS to improve forensic coverage during the exposure window.

bash

# Verify SharePoint build after patch deployment
Get-SPFarm | Select-Object BuildVersion
Get-SPProduct -Local | Select-Object ProductName, PatchableUnitDisplayName, Version