Microsoft SharePoint Remote Code Execution Vulnerability via Untrusted Data Deserialization

A remote code execution vulnerability has been identified in Microsoft Office SharePoint. This issue arises from the deserialization of untrusted data, allowing an authorized attacker to execute code over the network. The vulnerability affects multiple versions of SharePoint, including SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected SharePoint server, with the injected code running in the context of the SharePoint application.

Remediation

Security updates are available for SharePoint Server Subscription Edition (KB5002705), SharePoint Server 2019 (KB5002691), and SharePoint Enterprise Server 2016 (KB5002692).