The vulnerability is due to improper input validation in Microsoft SharePoint Server, which allows an authorized attacker to execute arbitrary code over the network. Because it enables remote code execution, an attacker could gain full control of the affected SharePoint instance and compromise data confidentiality, integrity, and availability. The weakness is identified as CWE-20 (Input Validation).

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are affected. No specific sub‑versions are listed; the vulnerability applies to all builds of these products as indicated by the CPE entries in the advisory.

With a CVSS score of 8.8 the vulnerability is classified as High; the EPSS score of 1% indicates a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The exploit requires an authenticated attacker with administrative privileges; once authenticated, the attacker may send specially crafted requests to trigger code execution. The high severity and potential for full control make this a significant risk for affected SharePoint instances.