Deserialization of untrusted data in Microsoft Office SharePoint

CVE-2026-26114 is a .NET deserialization flaw in on-premises SharePoint's request/handler pipeline (CWE-502). An attacker with Site Member permissions POSTs a specially crafted serialized payload that SharePoint's binary/XML deserializer inflates into a malicious gadget chain, executing arbitrary code in the context of the SharePoint web application pool (typically a domain-joined service account). Affected builds are SharePoint Server 2016, SharePoint Server 2019, and SharePoint Subscription Edition; the fixes ship in KB5002850 (2016), KB5002845 (2019), and the Subscription Edition March 2026 cumulative update.

Vendor scored this 8.8 HIGH and that is the right call for the average deployment. It is not a *Critical* because PR:L is real — Site Member is not anonymous — but on any SharePoint farm used the way SharePoint is actually used (broad AD-group-based Site Member grants, guest access via B2B, self-service site creation), the population of eligible attackers is measured in thousands per tenant. The impact is domain-adjacent code execution on a server that typically holds keys to SQL back-ends, Search indexes, and secrets in the SharePoint configuration DB. No downgrade.

Why this verdict

• PR:L is a soft ceiling, not a floor. Site Member in most enterprises is granted via broad AD groups — the pool of eligible attackers is any phished internal user or federated guest, not a privileged handful.
• Role multiplier — SharePoint on-prem farm: the vulnerable component *is* the crown-jewel collaboration server; chain outcome is w3wp code execution → MachineKey extraction → farm-wide ViewState forgery → Secure Store credential dump → AD lateral movement via the domain-joined service account. Fleet-scale outcome on the affected component. This alone floors the verdict at HIGH.
• Class precedent is bad. Every prior SharePoint deserialization bug (ToolShell, CVE-2023-29357/24955, CVE-2024-38094) was weaponized within weeks and used in ransomware pre-cursor activity. Sibling CVE-2026-45659 is already on KEV in July 2026.
• Friction that keeps it out of CRITICAL: PR:L (auth required), no public weaponized PoC for *this specific* CVE yet, EPSS still ~2.4%, and most farms are not directly Internet-exposed.

Why not higher?

Not CRITICAL because authentication (PR:L) is genuinely required — this is not an unauthenticated ToolShell-class bug — and there is no confirmed in-the-wild exploitation of *this* CVE yet. If a weaponized PoC drops or CISA adds it to KEV, upgrade to CRITICAL same-day.

Why not lower?

Not MEDIUM because the role multiplier is too strong: 100% of installs of the affected product occupy the high-value role (SharePoint farm holding org documents, domain-joined, service-account-privileged). Downgrading below HIGH would ignore both the class precedent (every prior SharePoint deser bug was exploited) and the KEV-listed sibling CVE.

1. Apply March 2026 SharePoint CUs (KB5002850 / KB5002845 / SE March CU) — The only durable fix. For a HIGH verdict, the noisgate mitigation SLA gives you 30 days to stand up a temporary control and 180 days to complete rollout — but given the KEV-listed sibling CVE, pull that forward: mitigate within 7 days, patch within 30.
2. Rotate SharePoint farm MachineKey and Secure Store master key AFTER patching — Any prior exposure means MachineKey may already be exfiltrated. Post-patch rotation invalidates forged ViewState. Complete within 7 days of patching.
3. Restrict Site Member grants — audit and prune broad AD-group memberships — PR:L is only meaningful if the L-privilege pool is small. Run a report of every AD group nested into Site Member on every site collection, prune stale contractor and cross-department entries within 14 days.
4. Front the WFE with a WAF and block oversized/binary POST bodies to non-upload handlers — F5 ASM, Azure Front Door WAF, or Cloudflare with SharePoint managed rules can drop deserialization payloads. Deploy within the 30-day mitigation SLA.
5. Enable AMSI on IIS worker processes and validate SharePoint SE Antimalware integration — Catches known ysoserial.net gadget signatures during deserialization. Should already be on for SE; validate for 2016/2019 with the AMSI-enabled config.
6. Move the SharePoint service account into Protected Users and remove unconstrained Kerberos delegation — Breaks the AD-lateral-movement leg of the chain even if RCE succeeds. Complete within 30 days.

Run on each SharePoint Server (WFE and app servers) as a local administrator in an elevated PowerShell. Invoke as .\Check-CVE-2026-26114.ps1. Reports VULNERABLE / PATCHED / UNKNOWN based on installed build vs. the March 2026 patched builds.

#requires -RunAsAdministrator
# Check-CVE-2026-26114.ps1
# Detects unpatched SharePoint Server 2016 / 2019 / Subscription Edition
# for CVE-2026-26114 (deserialization RCE, March 2026 CU).

$ErrorActionPreference = 'Stop'

# Patched build floors from March 2026 CU
$patchedBuilds = @{
    '16.0.5' = [Version]'16.0.5513.1000'   # SharePoint Server 2016  (KB5002850)
    '16.0.10'= [Version]'16.0.10417.20038' # SharePoint Server 2019  (KB5002845)
    '16.0.17'= [Version]'16.0.17928.20164' # Subscription Edition March 2026 CU
}

function Get-SPBuild {
    try {
        $key = 'HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0\WSS'
        if (-not (Test-Path $key)) { return $null }
        $v = (Get-ItemProperty -Path $key -Name 'BuildVersion' -ErrorAction Stop).BuildVersion
        return [Version]$v
    } catch { return $null }
}

$build = Get-SPBuild
if (-not $build) {
    Write-Output 'UNKNOWN: SharePoint not detected on this host.'
    exit 2
}

$majorMinorRev = '{0}.{1}.{2}' -f $build.Major, $build.Minor, $build.Build
$sku = switch -Regex ($majorMinorRev) {
    '^16\.0\.5'   { '16.0.5' ; break }
    '^16\.0\.10'  { '16.0.10'; break }
    '^16\.0\.1[6-9]' { '16.0.17'; break }
    default { $null }
}

if (-not $sku) {
    Write-Output "UNKNOWN: unrecognized SharePoint build $build"
    exit 2
}

$floor = $patchedBuilds[$sku]
if ($build -ge $floor) {
    Write-Output "PATCHED: build $build >= required $floor (SKU $sku)"
    exit 0
} else {
    Write-Output "VULNERABLE: build $build < required $floor (SKU $sku) — apply March 2026 CU"
    exit 1
}

Sources

1. Rapid7 vulndb — CVE-2026-26114
2. SentinelOne vulnerability database — CVE-2026-26114
3. Cisco Talos — Microsoft Patch Tuesday March 2026
4. CVEDetails — CVE-2026-26114
5. Windows Forum — March 2026 Patch analysis
6. The Hacker News — Sibling SharePoint CVE-2026-45659 added to KEV
7. SecurityWeek — CISA warns of actively exploited SharePoint vulnerability
8. TheHackerWire — Microsoft SharePoint Deserialization RCE analysis