CVE-2026-26114 · Microsoft SharePoint Server Deserialization of Untrusted Data Remote…

01 · The Real Story

Someone left the factory door locked but handed out keys to every employee, and the forklift inside can reach every shelf in the warehouse

CVE-2026-26114 is a CWE-502 insecure-deserialization vulnerability in Microsoft SharePoint Server 2016 Enterprise and SharePoint Server 2019. When a user with *any* valid SharePoint credential submits a crafted serialized .NET object to a vulnerable endpoint, SharePoint deserializes it through a permissive formatter (likely BinaryFormatter or ObjectStateFormatter), triggering a gadget chain — TypeConfuseDelegate, TextFormattingRunProperties, or similar — that executes arbitrary code as the SharePoint application-pool identity (w3wp.exe). The attacker does not need site-collection admin rights; any authenticated user with PR:L access will do. Microsoft patched it in the March 2026 Patch Tuesday rollup, with KB5002850 covering SharePoint Server 2016 and a parallel cumulative update for SharePoint Server 2019.

Microsoft rated this 8.8 HIGH, and on paper that's defensible — the CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately describes an authenticated network RCE with full CIA impact. But the vendor score does not discount for real-world friction: authentication is *required*, most on-prem SharePoint farms sit behind VPN or reverse proxy (only ~3,300 of ~30,000 public-facing portals are self-hosted per Shodan/Censys 2026 data), and there are no confirmed in-the-wild campaigns targeting this specific CVE. A public PoC with a Metasploit module (GitHub user huynambka) does exist, which compresses the window between patch release and opportunistic exploitation. noisgate downgrades the effective severity to 7.5 HIGH — still urgent, but not the hair-on-fire 8.8 the vendor label implies.

"Authenticated SharePoint deser RCE with public Metasploit module — farm account is the real prize"

02 · The Attack Path

5 steps from start to impact.

STEP 01

Obtain valid SharePoint credentials

The attacker needs any low-privilege account that can authenticate to the SharePoint web application. This can come from credential phishing, password spraying against an exposed OWA/ADFS login, credential stuffing with leaked databases, or a prior compromise of any domain user in the organization. In enterprises running SharePoint, the authenticated user population is typically hundreds to thousands of employees — a large target surface for credential theft.

Conditions required:

Valid domain or local SharePoint credentials
Network path to the SharePoint web front-end (HTTPS 443)

Where this breaks in practice:

Requires a prior credential compromise — this is NOT an unauthenticated bug
MFA on the SharePoint site or the upstream IdP (ADFS, Azure AD, Okta) blocks sprayed or stuffed credentials
Most enterprise SharePoint 2016/2019 farms are behind VPN, reverse proxy, or not internet-exposed at all

Detection/coverage: Failed authentication attempts visible in IIS logs, Windows Security event log (4625), and IdP audit logs. Password-spray detection in Azure AD Identity Protection or CrowdStrike Falcon Identity.

STEP 02

Craft a malicious .NET serialized payload

Using ysoserial.net, the attacker generates a BinaryFormatter payload with a gadget chain such as TypeConfuseDelegate or TextFormattingRunProperties. The payload embeds an OS command (e.g., PowerShell reverse shell or certutil download cradle). The public PoC by huynambka automates this step in Python and a Metasploit module (sharepoint_cve_2026_26114.rb), reducing the skill barrier to script-kiddie level.

Conditions required:

ysoserial.net or the huynambka PoC tooling
Knowledge of the target SharePoint version (2016 vs 2019) for endpoint selection

Where this breaks in practice:

Payload generation is trivial — ysoserial.net is a one-liner
No friction here; gadget chains ship with the .NET framework itself

Detection/coverage: Static signatures for ysoserial output exist in some IDS/IPS rule sets (Snort SID ranges, Suricata ET rules for .NET deserialization). Nuclei template coverage is likely within weeks of PoC publication.

STEP 03

Submit payload to the vulnerable endpoint

The attacker authenticates to SharePoint using NTLM or Kerberos (the PoC uses requests-ntlm) and POSTs the serialized payload to the deserialization endpoint. SharePoint's server-side code passes the payload to the insecure deserializer without validation, triggering the gadget chain. Execution occurs as the IIS application-pool identity — typically NT AUTHORITY\IUSR or a dedicated SharePoint service account.

Conditions required:

Authenticated HTTP(S) session to the SharePoint farm
The target farm has not applied the March 2026 cumulative update

Where this breaks in practice:

WAF rules inspecting POST bodies for .NET serialization magic bytes (AAEAAAD base64 prefix, 00 01 00 00 00 FF FF FF FF binary) can block the payload
SharePoint farms on Subscription Edition with recent hardening may have restricted dangerous deserializers

Detection/coverage: WAF/IPS inspection of POST payloads. IIS request logging (W3C extended) will show the suspicious endpoint hit. Microsoft Defender for Endpoint raises alerts on anomalous w3wp.exe child processes.

STEP 04

Code execution as the SharePoint app-pool identity

The deserialized gadget chain executes the embedded command in the context of the SharePoint worker process. The attacker now has code execution on the SharePoint server, typically running as a domain service account with SeImpersonatePrivilege. From here, the attacker can dump the SharePoint web.config to extract the farm passphrase and MachineKey, read all site-collection content databases via the farm account's SQL Server access, and pivot laterally.

Conditions required:

Successful deserialization (step 3 succeeded)
No application-layer sandboxing of the worker process

Where this breaks in practice:

EDR on the SharePoint server should detect anomalous child processes of w3wp.exe (cmd.exe, powershell.exe, certutil.exe)
AppLocker or WDAC policies blocking unapproved binaries from executing under the IIS app pool

Detection/coverage: Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne — all detect anomalous process trees from w3wp.exe. Sysmon Event ID 1 (Process Create) with parent w3wp.exe is a high-fidelity alert.

STEP 05

Harvest farm account and pivot to SQL Server / AD

The SharePoint farm account typically holds db_owner or sysadmin on the SharePoint content and config SQL databases. The attacker extracts the farm account credentials from web.config or the Windows credential store, then connects to SQL Server to exfiltrate document content, extract additional credentials, or execute xp_cmdshell for further lateral movement. In poorly segmented environments, the farm account's Kerberos SPN is kerberoastable, and the account may have replication or other elevated AD permissions.

Conditions required:

Code execution on the SharePoint server (step 4)
Farm account has SQL Server privileges (standard in all SharePoint deployments)
Network path from SharePoint server to SQL Server (always exists by design)

Where this breaks in practice:

Credential Guard on the SharePoint server prevents LSASS credential dumping
SQL Server auditing and Defender for SQL detect anomalous queries from the farm account
Network micro-segmentation between SharePoint and non-SharePoint SQL instances limits blast radius

Detection/coverage: SQL Server audit logs, Windows Security event 4624 (logon type 3) from unexpected sources, Defender for Identity alerts on anomalous Kerberos ticket requests.

03 · Compensating Control

HIGH 7.5→IGNORE 0.0

SEVERITY REDUCED

Apply the March 2026 cumulative update (KB5002850 / parallel CU for SP2019) — This is the definitive fix. The patch closes the deserialization endpoint. Per the noisgate remediation SLA for HIGH, deploy within 180 days — but given the public Metasploit module, front-load this into your next maintenance window. Test in a non-production farm first; SharePoint CUs occasionally break custom solutions.

HIGH 7.5→MEDIUM 5.5

SEVERITY REDUCED

Deploy WAF rules blocking .NET deserialization payloads — Configure your WAF (F5 ASM, Cloudflare, AWS WAF, Azure Front Door) to inspect POST bodies for .NET BinaryFormatter magic bytes (AAEAAAD in base64, 00 01 00 00 00 FF FF FF FF in hex). This catches the ysoserial-generated payloads used by the public PoC. Per the noisgate mitigation SLA for HIGH, deploy within 30 days.

HIGH 7.5→MEDIUM 5.0

SEVERITY REDUCED

Enforce MFA on all SharePoint authentication paths — Since PR:L is the gating prerequisite, enforcing MFA via ADFS, Azure AD Conditional Access, or Okta on all SharePoint access breaks the credential-stuffing and phishing paths that supply the attacker's initial authentication. This does not stop insider threats but eliminates the majority of external attack scenarios. Deploy within 30 days per noisgate mitigation SLA.

HIGH 7.5→HIGH 6.5

Harden EDR monitoring on SharePoint servers — Ensure your EDR agent (Defender for Endpoint, CrowdStrike, SentinelOne) is deployed on all SharePoint web front-ends and configured to alert on anomalous w3wp.exe child processes (cmd.exe, powershell.exe, certutil.exe, mshta.exe). This does not prevent exploitation but detects it within seconds and enables automated containment. Deploy within 30 days.

HIGH 7.5→MEDIUM 5.5

SEVERITY REDUCED

Restrict SharePoint service account privileges — Audit the SharePoint farm account's SQL Server permissions and AD group memberships. Remove sysadmin if possible (use db_owner on individual content databases only). Disable xp_cmdshell. Mark the farm account as *sensitive and cannot be delegated* in AD to prevent Kerberos delegation abuse. This shrinks the blast radius from domain-level to host/tenant-level.

What doesn't work

Network segmentation alone — SharePoint *must* talk to its SQL Server and AD by design; you cannot firewall off the exact paths the attacker would use for lateral movement without breaking the product.
Disabling .NET BinaryFormatter via runtimeconfig.json — SharePoint relies on legacy serialization internally; disabling BinaryFormatter at the framework level will break SharePoint functionality entirely.
IP allowlisting on IIS — in a typical enterprise, hundreds of users need SharePoint access from diverse networks; allowlisting is impractical and breaks remote/hybrid work patterns.
SharePoint audit logging alone — logs record *who* accessed *what content* but do not inspect or block deserialization payloads in transit; this is a detection-only control with no prevention value.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Status	No confirmed exploitation. Not on CISA KEV as of 2026-10-03. No named campaigns. However, the adjacent SharePoint deser family (CVE-2026-45659, CVE-2026-50522, CVE-2026-58644) saw active exploitation in the July 2026 Operation FarmKey campaign per Resecurity, demonstrating that threat actors are actively hunting SharePoint deser bugs.
Proof-of-Concept	Public PoC available. GitHub repo huynambka/cve-2026-26114-poc includes a Python exploit (`requests` + `requests-ntlm`) and a Metasploit module (`sharepoint_cve_2026_26114.rb`). Listed in nomi-sec/PoC-in-GitHub and indexed on pocindex.io.
EPSS	2.286% (83rd percentile per GHSA/FIRST). Alternate sources report 3.03% (87th percentile). Moderately elevated — indicates the model sees realistic exploitation probability despite no KEV listing.
CISA KEV	Not listed as of 2026-10-03. No binding operational directive applies.
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` — Network-accessible, low complexity, low privilege required, no user interaction, full CIA impact. The `PR:L` is the key differentiator from a 9.8; without it this would be critical.
Affected Versions	Microsoft SharePoint Server 2016 Enterprise Edition and SharePoint Server 2019 (on-premises). SharePoint Online / Microsoft 365 is not affected (Microsoft manages patching). SharePoint Server Subscription Edition status is unconfirmed but likely affected given shared codebase.
Fixed Versions	March 2026 cumulative update: KB5002850 (SharePoint Server 2016). Parallel CU for SharePoint Server 2019 via MSRC. Apply via Microsoft Update Catalog or WSUS.
Internet Exposure	Per Shodan/Censys 2026 scans: ~30,000 public-facing SharePoint portals total, of which ~3,300 are self-hosted on-prem instances (the rest are M365/SharePoint Online). This is a relatively small internet-exposed footprint, but internal exposure is vast.
Disclosure	Published 2026-03-10 (March Patch Tuesday). Coordinated disclosure via MSRC. No credited external researcher in the advisory — likely found internally or via MAPP.
Related CVEs	Part of a broader SharePoint deserialization lineage: CVE-2025-53770, CVE-2025-49706, CVE-2026-45659, CVE-2026-50522, CVE-2026-58644. The ToolShell and Operation FarmKey campaigns chained similar bugs for domain compromise.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to HIGH (7.5/10)

Why this verdict

Authentication barrier is real friction. PR:L means the attacker needs a valid credential before touching the deser endpoint. This is not unauthenticated spray-and-pray — it requires a prior compromise step (phishing, credential stuffing, insider) that modern controls (MFA, conditional access, IdP anomaly detection) can break. Adjusted downward ~0.5 from baseline.
Limited internet exposure. Only ~3,300 self-hosted SharePoint instances are internet-facing per Shodan/Censys 2026 data. The vast majority sit behind VPN, reverse proxy, or corporate network boundaries, meaning the attacker typically needs internal network access first — implying post-initial-access. Adjusted downward ~0.5.
No confirmed exploitation of this specific CVE. Despite a public PoC and Metasploit module being available since March 2026, CVE-2026-26114 is not on CISA KEV and no campaigns have been attributed to it. The adjacent CVEs (CVE-2026-45659, CVE-2026-58644) *have* been exploited, which keeps urgency elevated but doesn't justify the full 8.8 for this specific bug.
PoC + Metasploit availability prevents further downgrade. The huynambka PoC is weaponized and turnkey. Any authenticated user with the Metasploit module can achieve RCE. This compresses the exploitation timeline and limits how far below 8.8 we can responsibly go.
Role multiplier: SharePoint Server is canonically a data-tier application holding enterprise documents, HR data, executive communications, and regulated content. (a) *Low-value role* (dev/test farms): blast radius is host-level, negligible. (b) *Typical role* (production collaboration platform): RCE yields access to all site-collection content, potential exfiltration of sensitive documents — blast radius is tenant-level. (c) *High-value role* (production SharePoint farm with privileged farm account): The farm account typically has SQL db_owner/sysadmin on content databases. Compromise chain extends SharePoint RCE → farm account credential theft → SQL Server compromise → potential AD lateral movement via Kerberoasting or silver ticket. Blast radius is domain-level in poorly segmented environments. This high-value-role outcome applies to a meaningful fraction of on-prem SharePoint deployments (most production farms have privileged farm accounts by design), establishing a verdict floor of HIGH. The auth requirement prevents escalation to CRITICAL.

Why not higher?

This is not CRITICAL because the attack requires valid credentials (PR:L), which gates exploitation behind a prior compromise step. Only ~3,300 self-hosted instances are internet-exposed, and the vulnerability is not being actively exploited in confirmed campaigns. The S:U (Scope: Unchanged) vector means the vulnerability itself does not grant cross-trust-boundary escalation — the domain-level impact requires chaining additional steps (credential harvesting, SQL pivot) that EDR and segmentation can interrupt.

Why not lower?

This cannot be MEDIUM because a weaponized Metasploit module exists, the auth requirement is trivially satisfiable in large enterprises (hundreds of users have SharePoint access), and the blast radius on production farms extends to all document content and potentially to the SQL tier and AD domain. The adjacent SharePoint deser family is under active exploitation (Operation FarmKey), demonstrating real threat-actor interest in this exact bug class. The high-value-role floor analysis confirms that domain-level compromise is a realistic outcome in ≥10% of on-prem SharePoint deployments.

06 · Verification

Crowdsourced verification payload.

Run this script on each SharePoint server (web front-end and application tier) as a local administrator. It checks the installed SharePoint build number against the March 2026 security update. Example: .\Check-CVE202626114.ps1 in an elevated PowerShell session. No network access or credentials required beyond local admin.

noisgate-verify.ps1

POWERSHELLREAD-ONLYSAFE

#Requires -RunAsAdministrator
<#
  Check-CVE202626114.ps1
  Checks whether the SharePoint server has the March 2026 security update
  that fixes CVE-2026-26114 (deserialization RCE).
  Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

try {
    Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop
} catch {
    Write-Host "UNKNOWN - SharePoint PowerShell snapin not available. Is this a SharePoint server?"
    exit 2
}

try {
    $farm = Get-SPFarm -ErrorAction Stop
    $build = $farm.BuildVersion
    $major = $build.Major
    $minor = $build.Minor
    $buildNum = $build.Build
    $rev = $build.Revision

    Write-Host "Detected SharePoint build: $major.$minor.$buildNum.$rev"

    # SP2016 March 2026 CU (KB5002850): 16.0.5495.1000 or later
    # SP2019 March 2026 CU: 16.0.10416.20000 or later
    $vulnerable = $false

    if ($major -eq 16 -and $minor -eq 0) {
        if ($buildNum -lt 5495) {
            # SP2016, below March 2026 CU
            $vulnerable = $true
            Write-Host "SharePoint 2016 detected. Build is below KB5002850 threshold (16.0.5495.1000)."
        } elseif ($buildNum -ge 10400 -and $buildNum -lt 10416) {
            # SP2019, below March 2026 CU
            $vulnerable = $true
            Write-Host "SharePoint 2019 detected. Build is below March 2026 CU threshold (16.0.10416.20000)."
        } elseif ($buildNum -ge 5495 -or $buildNum -ge 10416) {
            $vulnerable = $false
        } else {
            Write-Host "UNKNOWN - Build number $buildNum does not match known SP2016 or SP2019 ranges."
            exit 2
        }
    } else {
        Write-Host "UNKNOWN - Unexpected SharePoint major version: $major.$minor"
        exit 2
    }

    if ($vulnerable) {
        Write-Host "VULNERABLE - CVE-2026-26114: SharePoint build $build is missing the March 2026 security update."
        exit 1
    } else {
        Write-Host "PATCHED - CVE-2026-26114: SharePoint build $build includes the March 2026 security update."
        exit 0
    }
} catch {
    Write-Host "UNKNOWN - Error querying SharePoint farm: $($_.Exception.Message)"
    exit 2
}