Microsoft SharePoint Server Untrusted Deserialization Remote Code Execution

#requires -Version 5.1
# Check-CVE-2026-33112.ps1
# Detects patched vs vulnerable SharePoint Server on-prem builds for CVE-2026-33112.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

param(
    [string]$MinBuildSubscription = '16.0.17928.20000',
    [string]$MinBuild2019         = '16.0.10416.20000',
    [string]$MinBuild2016         = '16.0.5504.1000'
)

$ErrorActionPreference = 'Stop'

function Compare-Version($a, $b) {
    $va = [Version]$a; $vb = [Version]$b
    return $va.CompareTo($vb)
}

try {
    # Prefer SharePoint snap-in when available
    if (-not (Get-PSSnapin -Name Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue)) {
        Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop
    }
    $farm = Get-SPFarm
    $build = $farm.BuildVersion.ToString()
    Write-Host "[INFO] Detected SharePoint farm build: $build"

    # Product SKU detection
    $product = (Get-SPProduct | Where-Object { $_.ProductName -match 'SharePoint Server' } | Select-Object -First 1).ProductName
    Write-Host "[INFO] Product SKU: $product"

    $minBuild = $null
    if     ($product -match 'Subscription') { $minBuild = $MinBuildSubscription }
    elseif ($product -match '2019')         { $minBuild = $MinBuild2019 }
    elseif ($product -match '2016')         { $minBuild = $MinBuild2016 }
    else {
        Write-Warning "[UNKNOWN] Unrecognized SharePoint SKU: $product"
        exit 2
    }

    if ((Compare-Version $build $minBuild) -ge 0) {
        Write-Host "[PATCHED] Build $build >= required $minBuild for CVE-2026-33112"
        exit 0
    } else {
        Write-Host "[VULNERABLE] Build $build < required $minBuild for CVE-2026-33112"
        exit 1
    }
}
catch {
    Write-Warning "[UNKNOWN] Could not determine SharePoint build: $($_.Exception.Message)"
    exit 2
}