The vulnerability arises from deserialization of untrusted data within Microsoft SharePoint, allowing an authorized attacker to execute code on the server. This flaw is classified as CWE-502 and can lead to full compromise of the affected system, granting the attacker control over confidentiality, integrity, and availability of the SharePoint environment.

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are affected. No specific patch versions are provided in the input beyond the product names.

The CVSS score of 8.8 indicates a high severity. EPSS data is not available, so current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a network-based exploit that requires an attacker to have authorized access or sufficient SharePoint permissions to trigger the deserialization process.