Deserialization of untrusted data in Microsoft Office SharePoint

CVE-2026-65665 is a deserialization-of-untrusted-data flaw in Microsoft SharePoint Server that lets an authenticated attacker with Site Member (Contribute) privileges achieve remote code execution over the network. The vulnerability was disclosed 2026-08-11 as part of August 2026 Patch Tuesday. It affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 — all on-premises editions. Microsoft rates exploitation as "more likely." The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full CIA impact behind a low-privilege authentication gate.

Microsoft's HIGH / 8.8 rating is appropriate — but deceptively calm given the operational context. This is the *fourth* SharePoint deserialization RCE disclosed in 2026 (after CVE-2026-45659, CVE-2026-50522, and CVE-2026-58644). Two of those predecessors landed on CISA KEV after active exploitation, and a documented July 2026 campaign chained SharePoint deser RCE all the way to domain compromise via machineKey theft and farm-service-account pivoting. The 8.8 score correctly reflects the auth requirement, but the thin friction of 'Site Member' access in a platform built for mass collaboration makes the effective barrier much lower than a typical PR:L CVE. The vendor score stands — but the urgency is higher than the number suggests.

Why this verdict

• Authentication barrier (PR:L): Requires Site Member credentials — this is the primary friction point preventing unauthenticated mass exploitation. However, SharePoint is a collaboration platform where large user populations (employees, contractors, vendors, service identities) hold Contribute rights, making credential acquisition substantially easier than a typical PR:L CVE.
• No active exploitation or public PoC yet: Disclosed 2026-08-11, no known weaponization. This prevents an upgrade to CRITICAL despite the attack-path severity. Historical precedent (CVE-2026-45659 was weaponized within ~3 weeks of disclosure) suggests a narrow window.
• Role multiplier: SharePoint Server is canonically a high-value-role component. (a) *Low-value role:* rare — SharePoint dev/test instances exist but are a small fraction. (b) *Typical role:* line-of-business collaboration server with AD-integrated auth and SQL backends. (c) *High-value role:* production SharePoint farms where the farm service account holds dbcreator/securityadmin SQL roles and AD group memberships — the July 2026 campaign proved this chain ends in domain compromise. ≥80% of on-prem SharePoint installs occupy the typical-to-high-value spectrum. The blast radius floor is HIGH.
• Summer 2026 SharePoint exploitation wave: Three prior deserialization RCEs in the same codebase were exploited in the wild between May and July 2026, two landing on CISA KEV. This establishes a pattern of rapid weaponization for this vulnerability class in this product.
• Internet exposure is limited but irrelevant to the threat model: Only ~1,300 SharePoint servers are internet-facing per Shodan. But the July 2026 campaign targeted internal SharePoint via phished credentials and compromised endpoints — the attack does not require internet exposure.

Why not higher?

No active exploitation and no public PoC exist as of 2026-08-12 — the vulnerability was disclosed yesterday. The authentication requirement (Site Member) is a real barrier that prevents unauthenticated mass scanning and exploitation at scale. Upgrading to CRITICAL would require either confirmed active exploitation, KEV listing, or a public PoC demonstrating reliable weaponization.

Why not lower?

The documented July 2026 SharePoint exploitation wave proves the full chain from authenticated deserialization RCE to domain compromise is operationally viable. SharePoint Server's canonical deployment role — AD-integrated, farm-service-account with SQL admin rights, holding sensitive corporate documents — means the blast radius is fleet-scale. The 'exploitation more likely' rating from Microsoft and the rapid weaponization history of the three predecessor CVEs in this exact class make downgrading indefensible.

1. Restrict Site Member permissions to minimum necessary users — Audit SharePoint site collections and remove Contribute rights from external vendors, stale accounts, and service identities that don't need them. This shrinks the authenticated attack surface. Deploy within 30 days per noisgate mitigation SLA for HIGH severity.
2. Deploy WAF rules blocking .NET deserialization payloads — Configure your WAF (or SharePoint's Request Management Service) to inspect and block POST requests containing BinaryFormatter/LosFormatter/ObjectStateFormatter serialized payloads to SharePoint API endpoints. Known gadget chain signatures from ysoserial.net should be added. Deploy within 30 days.
3. Enable enhanced IIS and SharePoint audit logging — Turn on IIS Failed Request Tracing and W3C extended logging for all SharePoint web applications. Enable SharePoint ULS verbose logging for the Claims Authentication and General categories. Feed these into your SIEM for anomalous deserialization pattern detection.
4. Rotate SharePoint machineKeys — If you haven't rotated machineKeys since before May 2026, assume they may be compromised from the earlier exploitation wave. Generate new keys and deploy across all farm members. This invalidates any forged ViewState payloads from prior compromises.
5. Reduce farm service account privileges — Ensure the SharePoint farm service account does not hold sysadmin on SQL Server — it should have only dbcreator and securityadmin on the SharePoint databases specifically, not server-wide. Remove any unnecessary AD group memberships. This limits the blast radius of post-exploitation pivoting.
6. Network-segment SharePoint servers from domain controllers — Place SharePoint servers in a dedicated VLAN with firewall rules restricting outbound SMB/RPC/LDAP to only the specific domain controllers and SQL servers required. Block direct SharePoint-to-DC communication on ports associated with DCSync and Kerberoasting.

Run this on each SharePoint server as a local administrator. It checks the installed SharePoint build number against the August 2026 security update. Example: .\Check-CVE-2026-65665.ps1

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Checks whether the SharePoint server is patched against CVE-2026-65665.
.DESCRIPTION
    Compares installed SharePoint build number against known-patched August 2026 builds.
    Returns VULNERABLE, PATCHED, or UNKNOWN.
#>

try {
    $farm = [Microsoft.SharePoint.Administration.SPFarm]::Local
    if (-not $farm) {
        Write-Output "UNKNOWN - Unable to connect to local SharePoint farm."
        exit 2
    }
    $build = $farm.BuildVersion
    $major = $build.Major
    $minor = $build.Minor
    $buildNum = $build.Build
    $rev = $build.Revision

    Write-Output "Detected SharePoint build: $major.$minor.$buildNum.$rev"

    # Subscription Edition: patched build >= 16.0.19726.20000 (estimated August 2026 CU)
    # Server 2019:          patched build >= 16.0.10418.20000 (estimated August 2026 CU)
    # Server 2016:          patched build >= 16.0.5553.1000  (estimated August 2026 CU)

    $patched = $false

    if ($major -eq 16) {
        if ($buildNum -ge 19726) {
            # Subscription Edition, August 2026 or later
            $patched = $true
        } elseif ($buildNum -ge 10418 -and $buildNum -lt 19000) {
            # Server 2019, August 2026 or later
            $patched = $true
        } elseif ($buildNum -ge 5553 -and $buildNum -lt 10000) {
            # Server 2016, August 2026 or later
            $patched = $true
        }
    }

    if ($patched) {
        Write-Output "PATCHED - Build $major.$minor.$buildNum.$rev includes the fix for CVE-2026-65665."
        exit 0
    } else {
        Write-Output "VULNERABLE - Build $major.$minor.$buildNum.$rev is below the August 2026 security update."
        exit 1
    }
} catch {
    Write-Output "UNKNOWN - Error querying SharePoint farm: $_"
    exit 2
}

Sources

1. Cisco Talos — Microsoft Patch Tuesday August 2026
2. Lansweeper — Microsoft Patch Tuesday August 2026
3. Resecurity — From Web Request to Domain Compromise: July 2026 SharePoint Attacks
4. Penligent — CVE-2026-45659 SharePoint RCE Deep Dive
5. Petri — Internet-Exposed SharePoint Servers Remain Vulnerable
6. BleepingComputer — Critical SharePoint RCE Exploited to Steal Machine Keys
7. The Hacker News — SharePoint RCE CVE-2026-45659 Added to CISA KEV