The vulnerability arises from the deserialization of untrusted data in Microsoft SharePoint environments. An attacker that has authorized access can supply crafted serialized content that is automatically processed by SharePoint, leading to arbitrary code execution. This allows the attacker to compromise confidentiality, integrity, and availability of the affected SharePoint instance and potentially the entire domain.

The affected products are Microsoft SharePoint Enterprise Server 2016 and Microsoft SharePoint Server 2019. No specific patch versions are listed in the CNA data, so all installations of these products are potentially vulnerable until patched.

The CVSS base score of 8.8 indicates a high severity. The EPSS score is less than 1%, suggesting that current exploitation attempts are rare, and the vulnerability is not present in the CISA KEV catalog. Based on the description, the likely attack vector requires an authenticated user or service account with network access to send malicious input over standard SharePoint interfaces, enabling the exploitation of the deserialization flaw.