Microsoft SharePoint CVE-2026-47294: Brief Summary of a Deserialization to OS Command Injection RCE

Introduction

Microsoft SharePoint's on-premises server line remains one of the most actively targeted enterprise attack surfaces in 2026. CVE-2026-47294 continues a pattern that has run for more than a year. It is a deserialization vulnerability that enables remote code execution through OS command injection. It carries a CVSS 3.1 base score of 8.0 (HIGH) and affects all three supported on-premises SharePoint Server editions: Enterprise Server 2016, Server 2019, and Subscription Edition.

Much of this CVE's significance comes from its context. It follows at least nine other SharePoint deserialization RCE vulnerabilities disclosed between July 2025 and May 2026, several of which were confirmed exploited in the wild and added to the CISA Known Exploited Vulnerabilities catalog. Its CWE classification also breaks from that pattern, which suggests a distinct exploitation path worth a closer look.

Technical Information

Root Cause: Deserialization Leading to OS Command Injection

CVE-2026-47294 is described as a "deserialization of untrusted data" vulnerability in Microsoft Office SharePoint that allows an authorized attacker to execute code over a network. The flaw arises when SharePoint deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

The CWE classification is where this one differs. The description references deserialization, which would typically map to CWE-502 (Deserialization of Untrusted Data). The assigned CWE is CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). The six SharePoint RCE CVEs disclosed in May 2026 (CVE-2026-33110, CVE-2026-33112, CVE-2026-35439, CVE-2026-40357, CVE-2026-40365, CVE-2026-40403) were all classified under CWE-502, as was CVE-2026-20963 in January 2026.

MITRE defines CWE-78 as software constructing all or part of an OS command from externally influenced input without neutralizing, or while incorrectly neutralizing, special elements that could modify the intended command. Attackers can then run unauthorized operating system commands, which could be used to disable the product or to read and modify data the attacker is not authorized to access.

The dual classification implies a two-stage exploitation chain. SharePoint deserializes untrusted data, and during or after deserialization it fails to neutralize special elements in that data, which leads to OS command injection through the deserialized payload. The deserialization boundary is crossed first. The resulting objects or data then flow into a code path that constructs OS commands without adequate sanitization.

CVSS v3.1 Vector Analysis

The full CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, which yields a base score of 8.0.

The temporal metrics are Exploit Code Maturity Unproven (E:U), Remediation Level Official Fix (RL:O), and Report Confidence Confirmed (RC:C). The vendor has confirmed the vulnerability and released a fix, but no public exploit code exists yet.

The user interaction requirement (UI:R) is the main reason this CVE scores 8.0 while the May 2026 SharePoint CVEs score 8.8. Those did not require user interaction (UI:N). In practice, user interaction in SharePoint (opening a document, navigating to a page, clicking a link) is often trivial to obtain through social engineering or normal business workflows, so the practical severity gap may be narrower than the score difference suggests.

Attack Flow

Based on the CVSS vector, the CWE classification, and the vulnerability description, the likely exploitation chain runs in this order:

1. Authentication: The attacker obtains, or already has, low-level authorized access to the SharePoint environment (PR:L). This could be any authenticated user account.

2. Payload Crafting: The attacker builds malicious serialized data containing special elements designed to trigger OS command injection when deserialized.

3. Delivery: The attacker delivers the payload through a SharePoint feature that processes serialized data. The user interaction requirement (UI:R) suggests a mechanism such as a document upload, a web part interaction, or a similar SharePoint feature where another user (or the system acting on a user's behalf) must interact with the malicious content.

4. Deserialization: SharePoint processes the untrusted serialized data without adequate validation. The deserialized content flows into a code path that constructs OS commands.

5. Command Injection: SharePoint does not neutralize special elements in the deserialized data, so the attacker can inject arbitrary OS commands.

6. Execution: The injected commands run with the privileges of the SharePoint application pool identity, which typically means high impact to the server's confidentiality, integrity, and availability.

Microsoft has consistently stated that on-premises SharePoint deserialization vulnerabilities do not affect SharePoint Online in Microsoft 365. Only on-premises deployments of SharePoint Server are at risk.

Why CWE-78 Matters for Defenders

The CWE-78 classification changes what detection needs to look for. Detection rules built around CWE-502-style deserialization attacks (suspicious .NET deserialization patterns, gadget chain indicators, or known deserialization sinks) may miss an attack that ends in OS command injection. Defenders should also monitor for:

• Unexpected process creation from SharePoint application pool worker processes (w3wp.exe)
• OS command execution artifacts such as cmd.exe or powershell.exe spawned by IIS worker processes
• Anomalous command line arguments in processes spawned within the SharePoint application context

These are general indicators consistent with CWE-78 exploitation in a web application. They are not detection signatures specific to this CVE.

Affected Systems and Versions

Three Microsoft SharePoint Server product lines are affected:

SharePoint Online (Microsoft 365) is not affected. Hybrid deployments that include on-premises SharePoint Server components remain exposed on those on-premises servers.

CVE-2026-47294 was published on June 1, 2026, after the May 13, 2026 Patch Tuesday cycle, which may mean it was an out-of-band or late-cycle addition. KB article numbers for the CVE-2026-47294 security update have not been independently confirmed beyond the MSRC advisory reference.

Vendor Security History

Over the past year, Microsoft SharePoint Server has been under sustained pressure from deserialization and RCE vulnerabilities:

The July 2025 exploitation was serious enough that Microsoft published a dedicated blog post on its efforts to disrupt active exploitation of on-premises SharePoint vulnerabilities. Akamai's research found that over 20% of observed environments were exposed to SharePoint vulnerabilities during that period.

CVE-2026-20963 was especially serious. It was a CVSS 9.8 unauthenticated RCE, confirmed exploited in the wild and added to the CISA Known Exploited Vulnerabilities catalog on March 18, 2026. CERT-EU and the Canadian Centre for Cyber Security both issued advisories for it.

Security analysts described the six RCE vulnerabilities in SharePoint Server in May 2026 alone, all rated 8.8, as particularly challenging for on-premises SharePoint administrators. CVE-2026-47294 carries the pattern into June.

The recurring deserialization flaws suggest a structural weakness in how the on-premises product handles serialized data, one that has not been fully remediated at the architectural level. Organizations should plan for continued SharePoint RCE disclosures. Instead of relying solely on per-CVE patching, they should consider longer-term architectural mitigations such as network segmentation, WAF deployment, and, where feasible, migration to SharePoint Online.

References

• NVD: CVE-2026-47294
• CVE Record: CVE-2026-47294
• Microsoft Security Update Guide: CVE-2026-47294
• Microsoft: Disrupting Active Exploitation of On-Premises SharePoint Vulnerabilities
• MITRE CWE-78: OS Command Injection
• OWASP: Deserialization of Untrusted Data
• OWASP: Insecure Deserialization
• CISA: Adds One Known Exploited Vulnerability to Catalog (CVE-2026-20963)
• Akamai: SharePoint RCE Exploitations, Detections, and Mitigations
• Bleeping Computer: Critical Microsoft SharePoint Flaw Now Exploited in Attacks
• CERT-EU: Critical Vulnerability in SharePoint Exploited
• 6sense: Microsoft SharePoint Market Share
• Trend Micro: Proactive Security for CVE-2025-53770 and CVE-2025-53771
• CrowdStrike: May 2026 Patch Tuesday Analysis
• SentinelOne: CVE-2026-32201 SharePoint Server Auth Bypass
• Canadian Centre for Cyber Security: AL26-005