Deserialization of untrusted data in Microsoft Office SharePoint

CVE-2026-33112 is an untrusted deserialization flaw (CWE-502) in Microsoft Office SharePoint Server. An authenticated user with at least *contribute* rights on a site can submit a crafted serialized payload — typically via a form field, list item, or workflow parameter — that SharePoint's server-side handlers rehydrate without safe-type gating. The gadget chain executes in the context of the w3wp.exe app pool, which on default installs runs as a domain service account with rights across the farm. Affected: SharePoint Server Subscription Edition, SharePoint Server 2019 (pre-May 2026 CU), and SharePoint Server 2016 (pre-May 2026 CU).

Microsoft's HIGH / 8.8 rating is *approximately* correct but slightly generous on the friction side and slightly stingy on the blast-radius side. PR:L is real — you need a valid account with write access somewhere — but SharePoint farms in the real world hand out contribute rights liberally, and once RCE lands, the service account is typically a domain principal with access to Search, User Profile, Secure Store, and often SQL. We hold the line at HIGH rather than downgrading: the exploitation prerequisite is a phished cookie away, and the role multiplier on collab farms is severe.

Why this verdict

• Role multiplier — SharePoint is a canonical high-value-role component: every enterprise on-prem SharePoint farm runs as a domain service account with cross-farm authority. Chain outcome: farm compromise → Secure Store credential harvest → often domain-account pivot. Floor: HIGH.
• Authentication prerequisite (PR:L) is weak friction: any user with contribute rights suffices, and SharePoint contribute-rights are routinely handed out to entire org groups. A single phished session token satisfies step 1.
• No weaponized PoC yet keeps this below CRITICAL: EPSS 0.021 and no KEV mean the 30-day window is not on fire. If a Metasploit module lands or KEV-listing occurs, this jumps to CRITICAL.
• Internet exposure is narrow but internal exposure is universal: ~9k Shodan-visible instances is small, but on-prem SharePoint remains one of the most common lateral-movement targets in mid-to-large enterprises with hybrid identity.

Why not higher?

No public weaponized exploit, no KEV listing, and no observed campaigns as of 2026-07-08. The auth requirement, while weak, is non-zero — a purely external unauthenticated attacker with no prior foothold cannot land this. CRITICAL is reserved for pre-auth SharePoint RCE or confirmed in-the-wild use.

Why not lower?

Downgrading to MEDIUM would ignore the SharePoint role multiplier — this is the exact class of bug (deserialization → SYSTEM in w3wp → domain pivot) that produced the 2019 and 2023 mass-compromise events. The contribute-rights prerequisite is satisfied by essentially any authenticated user in most enterprises, so real-world friction is much lower than PR:L suggests.

1. Restrict SharePoint contribute/edit rights via emergency ACL review — Deserialization requires write access to a vulnerable handler. Audit site-collection permissions for over-provisioned contribute rights, especially on sites accessible to broad AD groups (Domain Users, All Employees). Deploy within 30 days per the noisgate mitigation SLA for HIGH.
2. Enforce MFA and Conditional Access on all SharePoint sign-ins — Kills the phishing / password-spray path to step 1. Configure Entra Conditional Access to require MFA + compliant device for all SharePoint access, including internal. Deploy within 30 days.
3. Rotate and least-privilege the SharePoint app-pool service accounts — Remove Kerberos delegation, deny local admin on member servers, restrict SQL rights to only content DBs needed. Blunts step 5 even if steps 1–4 land. Rotate within 30 days; permanent hardening within 90 days.
4. Enable AMSI-for-.NET and EDR block-mode on all SharePoint web front-ends — Windows Server 2019+ supports AMSI hooks in the CLR. AMSI catches stock ysoserial.net gadget families. Combined with EDR alerting on w3wp.exe spawning cmd/PowerShell, this is the highest-signal detection layer. Deploy within 30 days.
5. Egress-filter the SharePoint tier — SharePoint front-ends should not initiate outbound internet connections. A default-deny egress ACL on the WFE VLAN stops the standard C2 callback from step 4.

Run this on each SharePoint Server (WFE and application role) as a farm admin from an elevated SharePoint Management Shell. Invoke as: .\Check-CVE-2026-33112.ps1 -MinBuildSubscription 16.0.17928.20000 -MinBuild2019 16.0.10416.20000 -MinBuild2016 16.0.5504.1000. Requires local admin on the SharePoint host.

#requires -Version 5.1
# Check-CVE-2026-33112.ps1
# Detects patched vs vulnerable SharePoint Server on-prem builds for CVE-2026-33112.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

param(
    [string]$MinBuildSubscription = '16.0.17928.20000',
    [string]$MinBuild2019         = '16.0.10416.20000',
    [string]$MinBuild2016         = '16.0.5504.1000'
)

$ErrorActionPreference = 'Stop'

function Compare-Version($a, $b) {
    $va = [Version]$a; $vb = [Version]$b
    return $va.CompareTo($vb)
}

try {
    # Prefer SharePoint snap-in when available
    if (-not (Get-PSSnapin -Name Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue)) {
        Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop
    }
    $farm = Get-SPFarm
    $build = $farm.BuildVersion.ToString()
    Write-Host "[INFO] Detected SharePoint farm build: $build"

    # Product SKU detection
    $product = (Get-SPProduct | Where-Object { $_.ProductName -match 'SharePoint Server' } | Select-Object -First 1).ProductName
    Write-Host "[INFO] Product SKU: $product"

    $minBuild = $null
    if     ($product -match 'Subscription') { $minBuild = $MinBuildSubscription }
    elseif ($product -match '2019')         { $minBuild = $MinBuild2019 }
    elseif ($product -match '2016')         { $minBuild = $MinBuild2016 }
    else {
        Write-Warning "[UNKNOWN] Unrecognized SharePoint SKU: $product"
        exit 2
    }

    if ((Compare-Version $build $minBuild) -ge 0) {
        Write-Host "[PATCHED] Build $build >= required $minBuild for CVE-2026-33112"
        exit 0
    } else {
        Write-Host "[VULNERABLE] Build $build < required $minBuild for CVE-2026-33112"
        exit 1
    }
}
catch {
    Write-Warning "[UNKNOWN] Could not determine SharePoint build: $($_.Exception.Message)"
    exit 2
}

Sources

1. Microsoft Security Response Center — CVE-2026-33112 advisory
2. NVD entry for CVE-2026-33112
3. CISA KEV catalog
4. FIRST EPSS query
5. ysoserial.net — .NET deserialization gadget generator
6. Trend Micro ZDI advisories
7. Microsoft — Plan for least-privileged SharePoint service accounts
8. MITRE CWE-502: Deserialization of Untrusted Data