Brief Summary: CVE-2026-33112 — Deserialization RCE in Microsoft SharePoint Server

Introduction

A deserialization flaw in Microsoft SharePoint Server, patched in the May 2026 Patch Tuesday cycle, lets any authenticated user with basic site privileges execute arbitrary code on the server remotely. CVE-2026-33112 has a CVSS 3.1 base score of 8.8, low attack complexity, and no available workarounds. That makes it a serious risk for the hundreds of thousands of organizations running on-premises SharePoint deployments.

Technical Information

CVE-2026-33112 comes from the deserialization of untrusted data in Microsoft SharePoint Server and is categorized as CWE-502 (Deserialization of Untrusted Data). The full CVSS 3.1 vector string is:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

The attack vector is network based, attack complexity is low, privileges required are low (no administrative access needed), no user interaction is required, and the impact is high for confidentiality, integrity, and availability. The scope is unchanged, which means the impact is confined to the vulnerable component's security authority. In practice, that component is the SharePoint server itself.

Root Cause

SharePoint accepts serialized data from authenticated users and deserializes it without adequate validation. When an application deserializes untrusted input, an attacker can craft a malicious serialized object that triggers unintended operations, including arbitrary code execution, as it is deserialized. This is a well-understood vulnerability class in .NET environments, and SharePoint's server-side processing of user-supplied serialized data creates a direct path to code execution.

Attack Flow

Based on the available advisory details and the Zero Day Initiative's analysis, exploitation works like this:

1. The attacker authenticates to the target SharePoint server. Only low-level privileges are required. As the Zero Day Initiative notes, anyone with site privileges has the authentication needed to exploit this flaw. A Site Owner role is sufficient.

2. The attacker crafts a malicious serialized object designed to execute arbitrary commands when the SharePoint server deserializes it.

3. The attacker submits the crafted payload to the vulnerable SharePoint endpoint over the network. No user interaction is required on the server side.

4. The SharePoint server processes the incoming data and deserializes the untrusted payload without proper validation. The malicious object's deserialization logic executes and runs the attacker's code in the context of the SharePoint application process.

5. Successful exploitation fully compromises the SharePoint server, with high impact to confidentiality, integrity, and availability. The attacker can read sensitive data, modify content, and potentially disrupt service availability.

The low-privilege requirement is particularly concerning in enterprise environments, where many users hold site-level permissions. It significantly widens the pool of potential attackers to include compromised accounts, malicious insiders, and external attackers who have obtained any valid SharePoint credential.

Patch Information

Microsoft released official fixes on May 12, 2026, as part of the May 2026 Patch Tuesday cycle. The MSRC advisory marks the remediation level as "Official Fix," which confirms that a complete vendor solution is available. SharePoint is a closed-source product, so no source code diff is publicly available. The fix ships in cumulative binary security updates.

Microsoft has stated explicitly that this vulnerability has no mitigations or workarounds. Applying the patches is the only supported remediation.

Applicable Updates

KB5002868 applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016, so organizations running either variant need to install only that one update.

SHA-256 Hashes

KB5002863: E2B144E8C5F7F85F147EA3B553E5D5487685741D96E7E5E1951F0EC9AAF4BF20
KB5002870: E845346170CC689E8602FA81822713AE6257DE1472B4EB62062C6CA238628B03
KB5002868: 56A8E176D8A30F4E307EE4AB405A9FA55BB306932C2A4CA09A57A74223910679

Distribution Channels

All three updates are available through Microsoft Update (automatic delivery), the Microsoft Update Catalog (standalone download), and the Microsoft Download Center (direct download links). A restart may be required after installation.

Prerequisites

If your SharePoint farm runs SharePoint Workflow Manager, install KB5002799 (a November 2025 Workflow Manager update) before you apply any of these May 2026 cumulative updates. Skipping this step could cause Workflow Manager compatibility issues after patching.

For the Subscription Edition, administrators must make sure the current release version is installed before applying the patch.

Affected Systems and Versions

The following SharePoint editions are confirmed vulnerable:

• Microsoft SharePoint Server Subscription Edition (versions prior to build 16.0.19725.20280)
• Microsoft SharePoint Server 2019 (versions prior to build 16.0.10417.20128)
• Microsoft SharePoint Enterprise Server 2016 (versions prior to build 16.0.5552.1002)

Microsoft rates all three "Important" in severity, with an impact classification of "Remote Code Execution."

Vendor Security History

Sophisticated threat actors have targeted SharePoint before. Microsoft has documented two Chinese nation-state groups, Linen Typhoon and Violet Typhoon, exploiting SharePoint vulnerabilities to compromise internet-facing servers. A threat actor tracked as Storm 2603 has also used SharePoint flaws to deploy ransomware. Earlier in 2026, a critical SharePoint vulnerability patched in January was later exploited in active attacks, which prompted warnings from CISA.

As of the May 2026 disclosure, CVE-2026-33112 has not been observed in active exploitation, and no public exploit code exists. Advanced threat actors have weaponized SharePoint vulnerabilities quickly in the past, though, so organizations should not delay patching because of the current "Unproven" exploitability assessment.

References

• CVE-2026-33112: MSRC Security Update Guide
• CVE-2026-33112: NVD Entry
• KB5002863: Security Update for SharePoint Server Subscription Edition
• KB5002870: Security Update for SharePoint Server 2019
• KB5002868: Security Update for SharePoint Enterprise Server 2016
• Zero Day Initiative: The May 2026 Security Update Review
• BleepingComputer: Microsoft Patch Tuesday May 2026
• Microsoft Security Blog: Disrupting Active Exploitation of On Premises SharePoint Vulnerabilities
• BleepingComputer: Critical Microsoft SharePoint Flaw Now Exploited in Attacks
• Microsoft Download Center: KB5002868 for SharePoint Server 2016