Brief Summary: Microsoft SharePoint Server CVE-2026-110044 Deserialization Remote Code Execution for Site Members

Introduction

On most SharePoint farms, Site Member is an ordinary collaboration role handed out to large numbers of users, and nobody treats it as a path onto the server itself. Microsoft's November 10, 2026 update for SharePoint Server Subscription Edition closes a deserialization flaw, CVE-2026-110044, through which a user holding exactly that role could send a crafted network request and execute code on the SharePoint server.

The CVSS v3.1 base score is 8.8 (High), and Microsoft's own severity rating is Important. The two classifications come from different systems and are not in conflict. The NVD entry lists the vendor as unknown and was still marked Awaiting Analysis at publication, so the score shown there is the one supplied by Microsoft as CNA. At publication Microsoft reported no public disclosure and no known exploitation, and a fix (KB5002945) is available. Below is a short review of what is and is not known, based on the advisory, the KB article, and the NVD and CVE records.

Technical Information

Root cause: CWE-502

Microsoft classifies the weakness as CWE-502, Deserialization of Untrusted Data. MITRE defines this as deserializing untrusted data without sufficiently verifying that the resulting data is valid, and notes that the consequences depend on which objects or methods are deserialized and how they are used. For this CVE, Microsoft confirms that the consequence is remote code execution on the SharePoint server.

SharePoint is closed source. There is no public commit, diff, or source-level advisory. Microsoft has not disclosed:

• which serializer or code path is involved
• the object or gadget chain
• the request endpoint or payload format
• the account or privilege level under which code runs

We therefore do not reproduce or speculate about vulnerable code here. In general, fixes for this bug class stop attacker-controlled data from choosing which .NET types get constructed during deserialization, either by tightening type allow lists or binders on the affected path, or by not deserializing that input at all. Microsoft has not said which approach KB5002945 takes, so treat that as background on the class rather than a description of this patch.

Attack flow, as documented by Microsoft

The MSRC FAQ describes a narrow scenario:

1. The attacker is authenticated and holds Site Member permissions on a site in an affected SharePoint Server Subscription Edition farm.
2. The attacker sends a specially crafted request over the network to the server.
3. The server deserializes attacker-influenced data without adequate validation.
4. Successful exploitation could execute code on the SharePoint server.

No user interaction is required, and Microsoft explicitly states that the Preview Pane is not an attack vector. This is the exploitation scenario Microsoft documents. It does not describe an observed intrusion, and it does not include anonymous exploitation or authentication bypass.

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Microsoft also publishes a temporal score of 7.7 with E:U (exploit code maturity Unproven), RL:O (remediation level Official Fix), and RC:C (report confidence Confirmed). The 8.8 base and 7.7 temporal scores measure different things.

Exploitation status

• MSRC at publication lists the CVE as Publicly disclosed: No and Exploited: No, with an assessment of Exploitation Less Likely.
• The Zero Day Initiative November 2026 review independently lists the CVE as Important, 8.8, not public, and not exploited.
• CISA SSVC data in the NVD record gives exploitation as none, automatable as no, and technical impact as total.

No named actor, campaign, CVE-specific indicator set, or public exploit has been identified. These are assessments at a point in time. They do not guarantee that undiscovered activity does not exist.

Patch Information

Microsoft fixed CVE-2026-110044 in the November 10, 2026 security update for SharePoint Server Subscription Edition, KB5002945. In the MSRC Security Update Guide this KB is the only security update listed for the CVE, Subscription Edition is the only affected product, and the CVSS Remediation Level is Official Fix.

Package SHA256:

31B944695F41590F52167E59EC3BF09DEA0590C9546C08D681607CE80E14F0E6

SharePoint updates are cumulative, so KB5002945 is the November build of the whole product rather than a standalone hotfix. The KB lists CVE-2026-110044 alongside 23 other CVEs, including the neighbouring SharePoint ID CVE-2026-110045. Installing this build or any later one includes the fix, and it also covers earlier monthly updates that may have been skipped.

Locating the changed component. Researchers who want to find the patched code can compare the per-file list Microsoft publishes for this update (linked from the KB as 5002945.csv) with the equivalent list for KB5002927, then diff the changed assemblies.

A wording note. The Download Center page says the update fixes code execution "when a maliciously modified file is opened." That is generic text covering the whole 24-CVE package. For this CVE, the MSRC FAQ describes an authenticated network request, not a file being opened.

Obtaining the update

1. Microsoft Update: installs automatically when automatic updating is enabled.
2. Microsoft Update Catalog: standalone package (search for KB5002945).
3. Microsoft Download Center: the full installer listed above, for Windows Server 2019 and 2022.

Prerequisites and behaviour changes from the KB

• The release version of SharePoint Server Subscription Edition must already be installed.
• If the farm runs SharePoint Workflow Manager, install KB5002799 first.
• Farms using the Classic Workflow Manager must add server debug flag 53601 to keep it working.
• The same KB includes non-security changes: a fix for the Search Host Controller service stopping unexpectedly after a manual restart, and time zone data updates. It also notes that blocking of remote event receivers registered without an app identity has moved to the March 2027 update.

The November CU release guidance also instructs administrators to run the SharePoint Products Configuration Wizard on each machine in the farm after installing the binaries.

Verifying the fix

An updated farm reports build 16.0.20326.20278 or later. Any server below that build remains exposed. A SharePoint farm only completes an update once every server has the new binaries and has run the configuration upgrade, so confirm the build on each server rather than on a single node.

MSRC does not document a separate workaround for this CVE. Microsoft separately notes that AMSI integration is enabled by default for all SharePoint web applications starting with Subscription Edition Version 23H2. That is general platform context, and Microsoft's guidance does not claim it provides specific protection against CVE-2026-110044.

Affected Systems and Versions

Additional notes:

• Subscription Edition is the only affected product listed in the MSRC Security Update Guide for this CVE. SharePoint in Microsoft 365, the Microsoft-hosted service, is not listed.
• Exploitation requires an account with Site Member permissions on a site in the affected farm.
• The Download Center installer targets Windows Server 2019 and Windows Server 2022.

Vendor Security History

The most relevant prior event is the 2025 ToolShell episode affecting on-premises SharePoint. Reuters reported that a July 8, 2025 patch did not fully address a flaw demonstrated at a May security competition, and that malicious activity involving apparent bypasses followed. Microsoft acknowledged the initial solution did not work and shipped further updates, documenting CVE-2025-53770 (related to CVE-2025-49704) and CVE-2025-53771 (a bypass of protections associated with CVE-2025-49706).

Microsoft attributed exploitation of those vulnerabilities to Linen Typhoon and Violet Typhoon, both Chinese nation-state actors, and to Storm-2603, a China-based actor observed deploying ransomware starting July 18, 2025. CISA's malware analysis of that incident described recovered webshells supporting command execution, file uploads, cookie operations, and PowerShell execution.

That history shows sustained attacker interest in SharePoint Server, and it includes an incomplete first fix followed by additional patches. It does not establish any actor, payload, endpoint, or indicator for CVE-2026-110044, and it does not suggest KB5002945 is ineffective. The two cases differ in mechanism (an authenticated Site Member request here versus a spoofing and RCE chain in 2025), in evidence (no known exploitation here versus observed attacks), and in remediation (a single named cumulative update here versus follow-up patches in 2025).

References

• NVD: CVE-2026-110044
• CVE record (CVE Services API): CVE-2026-110044
• NVD API record for CVE-2026-110044
• Microsoft Security Update Guide: CVE-2026-110044
• KB5002945: Security update for SharePoint Server Subscription Edition, November 10, 2026
• Microsoft Download Center: KB5002945 package
• Stefan Gossner: November 2026 CU for SharePoint Server Subscription Edition
• Zero Day Initiative: The November 2026 Security Update Review
• SharePoint updates: Office release notes
• CWE-502: Deserialization of Untrusted Data
• FIRST CVSS v3.1 Specification
• Configure AMSI integration with SharePoint Server
• What is SharePoint? (Microsoft Support)
• Microsoft named a Leader in the 2026 Gartner Magic Quadrant for Document Management
• Microsoft Security Blog: Disrupting active exploitation of on premises SharePoint vulnerabilities (2025)
• Reuters: Microsoft SharePoint patch timeline (2025)
• CISA MAR: Exploitation of SharePoint Vulnerabilities (2025)
• CISA: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities (2025)
• CISA Known Exploited Vulnerabilities feed