Deserialization Vulnerability in Microsoft Office SharePoint by Microsoft
CVE-2026-105013

7.4HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Sharepoint Server Subscription Edition
Vendor
CVE Published:
13 October 2026

What is CVE-2026-105013?

A deserialization vulnerability has been identified in Microsoft Office SharePoint, which can be exploited by an authorized attacker. This vulnerability allows the execution of arbitrary code over a network due to the improper handling of untrusted data. Attackers can leverage this security flaw to gain unauthorized access and control within the application environment, potentially leading to significant data breaches and system compromises. Users are advised to apply the recommended patches to mitigate this risk.

Affected Version(s)

Microsoft SharePoint Server Subscription Edition x64-based Systems 16.0.0 < 16.0.20326.20190

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.