Brief Summary: Microsoft SharePoint Server CVE-2026-123390 Authenticated Deserialization Remote Code Execution

Introduction

A user holding Site Owner rights on a SharePoint Server Subscription Edition farm could upload a crafted file and then use API requests to make the server deserialize that file's parameters, ending in code execution in the context of the SharePoint Server. Microsoft published the advisory for CVE-2026-123390 on November 10, 2026, but the fix itself shipped in the September 2026 Public Update, so many farms were protected two months before the CVE became public.

At a glance:

The CVSS score and Microsoft's Important rating come from different rating systems, so the two do not conflict.

Technical information

Root cause

Microsoft classifies the issue as CWE 502: deserialization of untrusted data without sufficiently ensuring that the resulting data is valid. MITRE notes that the consequences of this weakness class depend on which objects or methods are deserialized and how they are used. Here, the parameters of an uploaded file reach a deserialization path that an authenticated, sufficiently privileged user can trigger through the API.

SharePoint is closed source, and Microsoft has published no diff, commit, or code-level explanation. The GitHub Advisory entry (GHSA-427g-6hq9-hfx2) states "No known source code" and lists affected and patched versions as unknown. The MSRC FAQ is the only source of root-cause detail.

Attack flow

Based on Microsoft's disclosed sequence:

1. The attacker holds an authenticated account with Site Owner permissions or higher on the target SharePoint Server.
2. The attacker uploads a specially crafted file to the server.
3. The attacker sends specialized API requests that trigger deserialization of that file's parameters.
4. Successful exploitation results in code execution in the context of the SharePoint Server.

The attack requires an authenticated account, and no separate victim has to open the uploaded file. The FAQ describes attacker-controlled API requests, and the CVSS vector records no user interaction.

What has not been disclosed

The advisory does not name the endpoint, the file format, the serialization library, the gadget chain, the exact API request, or the operating system account under which code runs. No reproducible exploit material is published. Technical conclusions in this post therefore stay within the disclosed sequence of an upload followed by API-triggered deserialization. We deliberately do not borrow mechanics from unrelated SharePoint exploits.

For .NET deserialization bugs in general, fixes usually stop attacker-controlled data from reaching a powerful deserializer, for example through type allow lists or binder restrictions, or by switching that code path to a safer serializer. This is an informed inference about the class of fix. Microsoft has not confirmed how it implemented this particular one.

In the same release cycle, ZDI's November 2026 Security Update Review counts 30 SharePoint CVEs and describes the seven RCEs among them as "mainly deserialization of untrusted data." That suggests Microsoft is working through a family of related sinks rather than a single isolated bug.

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The PR:L value should not be read as "any basic account is sufficient." Exposure analysis should use the explicit Site Owner prerequisite from the FAQ.

Microsoft's temporal metrics bring the score to 7.7: Exploit Maturity Unproven, Remediation Level Official Fix, Report Confidence Confirmed. These supplement the 8.8 base score rather than replace it.

Exploitation status

Microsoft's advisory records "Exploited: No" and "Publicly disclosed: No", with an exploitability assessment of N/A. The CISA KEV catalog dated November 10, 2026 does not list the CVE. OffSeq Threat Radar labels it not known to be exploited and reports no indexed public exploit in Metasploit or Exploit DB (both OffSeq pages come from the same provider, so they are not independent confirmations). No threat actor attribution and no CVE-specific indicators have been published. The "not known to be exploited" label describes the available evidence and does not guarantee that private exploitation cannot occur.

Patch information

The MSRC entry lists a single affected product row:

NVD's CNA-supplied data uses the same boundary: affected from 16.0.0 up to, but not including, 16.0.20326.20136. Any farm at that build or later contains the fix.

The fix predates the CVE

KB5002908 is the September 08, 2026 Public Update for SharePoint Server Subscription Edition. The Download Center lists September 9, 2026 as its publication date. The KB5002908 support article enumerates 17 CVEs, and CVE-2026-123390 is not among them. Microsoft linked the CVE to that KB only when it published the November advisory. In practice, farms that installed the September 2026 PU or anything later have been protected since September, even though their KB notes never mentioned this CVE.

Supersedence chain

SharePoint PUs are cumulative:

Installing the current November package also brings in the September fix. The KB5002945 notes do not list CVE-2026-123390 either, so check the build number rather than a KB's CVE list.

Verifying the build

Check the farm build in Central Administration under Servers in Farm, or with PowerShell:

(Get-SPFarm).BuildVersion

The result should be 16.0.20326.20136 or higher.

Obtaining the package

KB5002908 is available through Microsoft Update, the Microsoft Update Catalog, and the Download Center (download ID 108810). The Subscription Edition package combines language-independent and language-dependent fixes, and Stefan Gossner notes that the Download Center language selection delivers the same package. Published SHA256 hashes for integrity checks:

uber-subscription-kb5002908-fullfile-x64-glb.exe
D55A79FC94D4050C4202B2839C889C7EB0ECC06FE837C3B38159CCAE173D455D

uber-subscription-kb5002945-fullfile-x64-glb.exe
31B944695F41590F52167E59EC3BF09DEA0590C9546C08D681607CE80E14F0E6

Deployment conditions

The last two items come from Stefan Gossner's September 2026 CU guidance. These conditions apply to deploying the update. None of them is an exploit prerequisite.

Related hardening in the same update

The KB5002908 release notes also describe attack surface reductions starting with the September 2026 CU:

• The GetDataFromDataSourceControl SOAP feature is disabled. It can be enabled per site collection with Enable-SPWebPartPagesDataSourceControl.
• The ExecuteProxyUpdates feature is disabled, controlled with Enable-SPWebPartPagesProxyUpdates and Disable-SPWebPartPagesProxyUpdates.
• The ToolPane feature is announced as disabled, controlled with Enable-SPToolPane and Disable-SPToolPane.
• SharePoint 2010 workflows are announced as disabled, controlled with Enable-SPLegacyWorkflow and Disable-SPLegacyWorkflow.

Microsoft does not tie any of these changes to CVE-2026-123390, so they should not be treated as the fix. They do show the September PU switching off several legacy server-side features by default. If an administrator turns one back on, that exposure is under their control rather than present by default.

No separate workaround

The advisory provides an official fix and no workaround. The AMSI, endpoint protection, and machine key rotation guidance from the 2025 SharePoint incidents is not documented as an alternative remediation for this CVE.

Affected systems and versions

• Microsoft SharePoint Server Subscription Edition (x64): versions from 16.0.0 up to, but not including, 16.0.20326.20136.
• Fixed in 16.0.20326.20136 (KB5002908) and all later builds, including 16.0.20326.20190 (KB5002927) and 16.0.20326.20278 (KB5002945).
• Vulnerable configuration: an attacker must hold Site Owner permissions or higher on the target server.

The CVE record does not list SharePoint Online, SharePoint Server 2016, or SharePoint Server 2019 as affected by this CVE. Their involvement in other SharePoint incidents should not be carried over to this record.

Vendor security history

SharePoint has a very large footprint. In its March 2, 2026 announcement, Microsoft reported more than 1 billion annual users, over 2 billion daily file uploads, and 2 million sites created daily. These figures describe platform adoption, not the number of vulnerable Subscription Edition servers.

The most relevant prior case is the 2025 ToolShell exploitation. Microsoft reported exploitation of on-premises SharePoint involving CVE-2025-49706 and CVE-2025-49704, and CISA described CVE-2025-53771 and CVE-2025-53770 as patch bypasses for those earlier issues. Microsoft attributed the activity to Linen Typhoon, Violet Typhoon, and Storm-2603. Storm-2603 used SharePoint exploitation for initial access, deployed a web shell, performed credential access and lateral movement, and distributed Warlock ransomware. Microsoft responded with security updates for Subscription Edition, 2019, and 2016, along with AMSI, endpoint protection, and machine key rotation followed by an IIS restart.

That case shows how a SharePoint compromise progressed beyond initial access, and that the initial patch did not fully close the issue at the time. It does not establish any shared exploit, actor, or affected edition with CVE-2026-123390, and it is not evidence that the current fix is incomplete.

References

• NVD: CVE-2026-123390
• CVE Record: CVE-2026-123390
• Microsoft Security Update Guide: CVE-2026-123390
• KB5002908 security update for SharePoint Server Subscription Edition (servicing page)
• KB5002908 description, September 08, 2026
• KB5002927 (October 2026)
• KB5002945 (November 2026)
• Microsoft Download Center: KB5002908
• Stefan Gossner: September 2026 CU for SharePoint Server Subscription Edition
• Zero Day Initiative: The November 2026 Security Update Review
• GitHub Advisory GHSA-427g-6hq9-hfx2
• MITRE CWE 502: Deserialization of Untrusted Data
• CISA Known Exploited Vulnerabilities catalog (JSON feed)
• OffSeq Threat Radar: Microsoft Office SharePoint deserialization entry
• OffSeq Threat Radar: SharePoint Server Subscription Edition entry
• Microsoft Security Blog: Disrupting active exploitation of on premises SharePoint vulnerabilities (2025)
• CISA: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities (2025)
• Microsoft 365 Blog: SharePoint at 25
• Microsoft Support: What is SharePoint?