CVE-2026-47294: Microsoft SharePoint Server Remote Code Execution Vulnerability

Synopsis

Deserialization of untrusted data in Microsoft SharePoint Server allows an authenticated attacker to execute arbitrary code remotely. The vulnerability is reachable over the network, requires a low-privilege account, and requires the targeted user to take some action (such as opening a malicious link or document). Successful exploitation gives the attacker full control over the affected server process, including reading, modifying, or destroying data. Patched-image rebuilds at versions 16.0.5552.1002, 16.0.10417.20128, and 16.0.19725.20280 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SharePoint service over the network; the vulnerable component is exposed via standard network access.

• AuthenticationRequired

  Any low-privilege SharePoint account is sufficient; no administrative or elevated permissions are needed.

• Victim interactionRequired

  A user on the target system must perform an action, such as visiting a crafted page or opening a malicious file, for the exploit to trigger.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• The attacker executes arbitrary code in the context of the SharePoint server process, gaining full control of that process.
• Confidential data stored in SharePoint, including documents, list data, and cached credentials, can be read directly.
• The attacker can modify or delete SharePoint content, site configurations, and persisted application data.
• The SharePoint service can be crashed or rendered unavailable, disrupting access for all users of that instance.