The vulnerability is a deserialization flaw in untrusted data in Microsoft Office SharePoint that permits an authorized attacker to execute arbitrary code over the network. The flaw occurs when user‑provided data is deserialized without proper validation, allowing the attacker to inject malicious payloads that the server processes, giving full control of the server. The associated weaknesses are CWE‑502 (Deserialization of Untrusted Data) and CWE‑88 (Argument Injection). This leads to a high impact on confidentiality, integrity, and availability, enabling compromised servers to run arbitrary commands as the SharePoint service account.

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are impacted. The vulnerability applies to all supported configurations of these products, regardless of deployment method or tenant. No specific service packs or minor revisions were indicated, so all current releases are considered vulnerable until a patch is applied.

The CVSS score of 8.8 indicates a high severity. The EPSS score of 2% shows a modest but measurable likelihood that this exploit may be used in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker requires legitimate authentication and the ability to submit a crafted payload to a deserialization endpoint on the SharePoint server. Once executed, the attacker can run code with the privileges of the SharePoint application pool, potentially taking full control of the affected system. The likely attack vector is remote over the network, requiring either exploitation of a public‑facing endpoint or local privilege escalation with valid user credentials.