Product:
Microsoft Office SharePoint
Summary
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. This vulnerability poses a significant risk as it can lead to unauthorized code execution, potentially compromising sensitive data and system integrity.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2026-40357 |
Exploitation
To exploit this vulnerability, an attacker must have authorized access to the Microsoft Office SharePoint environment. By sending specially crafted data to the application, the attacker can trigger the deserialization process, leading to the execution of arbitrary code on the server. This can be done remotely over the network without requiring user interaction.
Affected Products
- Microsoft Office SharePoint: Affected by deserialization vulnerabilities that allow code execution.
Mitigation
To mitigate this vulnerability, it is essential to apply the latest security updates provided by Microsoft. Additionally, organizations should review their access controls and ensure that only authorized users have access to the SharePoint environment. Regular security assessments and monitoring can also help detect and prevent potential exploitation.