Microsoft SharePoint Server CVE-2026-35439: Brief Summary of an Authenticated Deserialization RCE

Introduction

A deserialization flaw in Microsoft SharePoint Server, patched in the May 2026 Patch Tuesday cycle, lets any authenticated user with site-level privileges execute arbitrary code on the underlying server over the network. CVE-2026-35439 has a CVSS 3.1 base score of 8.8 and no available workarounds. That makes it a significant risk for organizations running on-premises SharePoint, particularly internet-facing deployments, where authentication is the only barrier between an attacker and full code execution.

Technical information

The vulnerability is classified under CWE-502: Deserialization of Untrusted Data. The root cause is in how SharePoint Server processes serialized objects it receives over the network. When the server deserializes attacker-controlled data without adequate validation, the attacker gets a direct path to arbitrary code execution in the context of the SharePoint application process.

The full CVSS 3.1 vector string is:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

By metric:

Authentication requirements

The authentication bar for this vulnerability is low. According to the Zero Day Initiative's May 2026 security update review, anyone with site privileges has the authentication needed to exploit the bug. Microsoft's own advisory says an attacker authenticated as at least a Site Owner could write arbitrary code to execute remotely on the server. The attacker does not need administrative or domain-level credentials. A standard site-level role is enough.

Attack flow

Based on the available technical details, exploitation would proceed as follows:

1. The attacker authenticates to the target SharePoint instance using any account with at least Site Owner privileges.
2. The attacker crafts a malicious serialized payload designed to execute arbitrary commands upon deserialization.
3. The attacker submits this payload to the vulnerable SharePoint endpoint over the network.
4. The server processes the request and deserializes the untrusted data, and the embedded code executes with the privileges of the SharePoint application process.

Because attack complexity is low and no user interaction is required, an attacker can run the whole chain, from authentication to code execution, programmatically. There are no special timing conditions or race windows to hit.

Patch information

Microsoft released official security updates on May 12, 2026, as part of the May 2026 Patch Tuesday cycle. The MSRC advisory lists the remediation level as "Official Fix." No workarounds or alternative mitigations are available, and Microsoft has marked customer action as "Required" for all three affected products.

Available patches

Each update is cumulative and also resolves several other CVEs bundled into the same release, including CVE-2026-40357, CVE-2026-33112, CVE-2026-33110, CVE-2026-40368, CVE-2026-40367, and CVE-2026-40365. One installation per affected product covers all May 2026 SharePoint fixes.

Prerequisites

If your farm runs SharePoint Workflow Manager, you must first install the Workflow Manager update KB5002799 (released November 2025). Farms still using the Classic version of Workflow Manager also need to enable a debug flag after installation, using the following PowerShell commands:

$farm = Get-SPFarm
$farm.ServerDebugFlags.Add(53601)
$farm.update()
iisreset

Obtaining and verifying patches

Patches are available through three channels:

• Microsoft Update, which delivers them automatically if automatic updating is enabled
• The Microsoft Update Catalog, for standalone packages
• The Microsoft Download Center, for direct download links

After deployment, administrators should verify that the SharePoint build number matches or exceeds the patched build listed above for their product edition. As an additional hardening measure, organizations should review and constrain Site Owner privileges to reduce the attack surface, since that role has enough access to trigger the exploit.

Affected systems and versions

The following on-premises Microsoft SharePoint Server editions are affected:

• Microsoft SharePoint Server Subscription Edition (versions prior to build 16.0.19725.20280)
• Microsoft SharePoint Server 2019 (versions prior to build 16.0.10417.20128)
• Microsoft SharePoint Enterprise Server 2016 (versions prior to build 16.0.5552.1002)

Internet-facing SharePoint instances are at higher risk, because the attack vector is network-based and the authentication requirement is low.

Vendor security history

Microsoft fixed CVE-2026-35439 in the May 2026 Patch Tuesday release, which addressed 120 vulnerabilities across Microsoft products, with no zero-days reported in the batch. SharePoint has a documented history as a target for threat actors. In July 2025, Microsoft published a blog post describing its efforts to disrupt active exploitation of on-premises SharePoint vulnerabilities. Microsoft currently assesses CVE-2026-35439 as "Exploitation Less Likely," but SharePoint vulnerabilities have a history of being weaponized after patch release, which suggests organizations should not delay remediation.

References

• MSRC Advisory: CVE-2026-35439
• NVD Detail: CVE-2026-35439
• KB5002863: Security update for SharePoint Server Subscription Edition
• KB5002870: Security update for SharePoint Server 2019
• KB5002868: Security update for SharePoint Enterprise Server 2016
• Zero Day Initiative: The May 2026 Security Update Review
• BleepingComputer: Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days
• Microsoft Security Blog: Disrupting active exploitation of on premises SharePoint vulnerabilities
• Action1: Patch Tuesday May 2026
• Cybersecurity News: Microsoft Patch Tuesday May 2026