The vulnerability is a deserialization of untrusted data flaw, classified as CWE‑502, that resides in Microsoft Office SharePoint. An attacker who is already authorized on the system can craft malicious serialized data and cause the SharePoint server to deserialize it, resulting in the attacker impersonating legitimate users or services over the network. This spoofing can enable the attacker to conceal malicious actions, gain unauthorized data access, or manipulate communications, thereby compromising the integrity and authenticity of the SharePoint environment.

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are affected. The vulnerability applies to the 2016 and 2019 product lines and to the Subscription Edition, with no further version granularity specified in the advisory.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of 1% points to a low but non‑zero probability of exploitation in the near term. The issue is not listed in the CISA KEV catalog, suggesting limited public exploitation. The most likely attack vector is network‑based, where a privileged or compromised user can submit crafted data to the SharePoint server. Internal threat actors or accounts that have been breached would pose the greatest risk, as the flaw requires an attacker to have some level of authorization to trigger the deserialization routine.