CVE-2026-45484: Microsoft SharePoint Elevation of Privilege Vulnerability

Synopsis

This is a deserialization of untrusted data vulnerability in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Edition). An authenticated attacker with a low-privilege account can reach the vulnerable endpoint over the network without any additional conditions or victim interaction. Successful exploitation grants the attacker elevated privileges, with full read, write, and availability impact on the affected SharePoint instance. Patched-image rebuilds at versions 16.0.5556.1005, 16.0.10417.20153, and 16.0.19725.20384 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SharePoint service over the network; there is no local-only or adjacent-network restriction.

• AuthenticationRequired

  Any low-privilege SharePoint account is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed to trigger exploitation.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout dependencies, or special environmental factors are required.

Blast Radius

• Attacker reads confidential SharePoint content, stored credentials, and site configuration data.
• Attacker modifies or deletes SharePoint documents, list items, and site settings.
• Attacker disrupts availability of the SharePoint service, causing it to become unresponsive to legitimate users.
• With elevated privileges, attacker can pivot to further administrative actions within the SharePoint farm.