Brief Summary: CVE-2026-33110 — Microsoft SharePoint Server Remote Code Execution via Unsafe Deserialization

Introduction

A deserialization flaw in Microsoft SharePoint Server, patched in the May 2026 Patch Tuesday cycle, lets any authenticated user with basic Site Member permissions execute arbitrary code remotely on the server. CVE-2026-33110 has a CVSS 3.1 base score of 8.8, with high impact on confidentiality, integrity, and availability. It is one of six Remote Code Execution vulnerabilities Microsoft fixed in SharePoint that month, and it arrived just weeks after a separate SharePoint zero day (CVE-2026-32201) was confirmed exploited in the wild in April 2026.

Technical Information

The root cause of CVE-2026-33110 is deserialization of untrusted data, classified under CWE-502. In .NET applications like SharePoint, deserialization vulnerabilities arise when the application accepts serialized objects from user-controlled input and reconstructs them without adequate validation. If an attacker can supply a crafted serialized payload, the deserialization process can instantiate arbitrary objects and trigger code execution on the server.

The vulnerability is reachable over the network (Attack Vector: Network) and has low attack complexity, so an attacker does not need specialized knowledge of the target environment to achieve repeatable exploitation. Microsoft's CVSS 3.1 vector string is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

The privilege requirement is low. The attacker must be authenticated, but Site Member permissions are enough, and Site Member is the default permission level granted to standard users in most SharePoint deployments. No user interaction is required. The attacker can compromise the vulnerable server alone, without any action from a victim or administrator.

Attack Flow

Exploitation would proceed as follows:

1. The attacker authenticates to the target SharePoint server using valid credentials with at least Site Member permissions.
2. The attacker crafts a malicious serialized payload targeting the vulnerable deserialization endpoint within SharePoint.
3. The attacker sends the payload over the network to the SharePoint server.
4. The server deserializes the untrusted data without proper validation, and the attacker's code executes in the context of the SharePoint application.
5. Depending on the server configuration and service account privileges, the attacker may achieve full control over the SharePoint server, access sensitive documents, pivot laterally within the network, or establish persistence.

Microsoft has not publicly disclosed which SharePoint component is vulnerable, and no public proof-of-concept exploit payloads are available at this time. The impact ratings (High for confidentiality, integrity, and availability) indicate that successful exploitation gives the attacker substantial control over the affected system.

Patch Information

Microsoft has released official patches for all supported on-premises editions of SharePoint Server. There are no workarounds, and applying the patch is the only mitigation Microsoft recommends. The MSRC advisory sets the Remediation Level to "Official Fix" and the Customer Action status to "Required", which means Microsoft considers this a mandatory security update.

The following Knowledge Base updates address CVE-2026-33110:

These cumulative updates are distributed through three channels: Microsoft Update (automatic delivery when automatic updates are enabled), the Microsoft Update Catalog (manual download of the standalone package), and the Microsoft Download Center (direct download links). To confirm the patch is in place, administrators should compare their SharePoint build number against the patched builds listed above.

Workflow Manager Prerequisite

All three KB articles warn that if your farm currently runs SharePoint Workflow Manager, you must first install the Workflow Manager update (KB5002799) and only then apply the May 2026 cumulative update. Farms running the Classic version of Workflow Manager must also enable a debug flag after installation, using these PowerShell commands:

$farm = Get-SPFarm
$farm.ServerDebugFlags.Add(53601)
$farm.update()
iisreset

Additional Notes

These cumulative updates supersede earlier patches: KB5002863 replaces KB5002853, KB5002870 replaces KB5002854, and KB5002868 replaces KB5002861. If you skipped the previous month's update, the May 2026 patch includes those prior fixes as well. The same KB number (KB5002868) applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016, so a single update covers both editions.

Affected Systems and Versions

The following Microsoft SharePoint Server products are affected:

All on-premises installations of these SharePoint Server editions running builds earlier than the patched versions above are vulnerable. Exploitation requires network access and authentication with at least Site Member permissions.

Vendor Security History

SharePoint shows up often in Microsoft's security advisories. In the May 2026 Patch Tuesday release alone, Microsoft fixed six distinct Remote Code Execution vulnerabilities in SharePoint, all with a CVSS score of 8.8. That is a notable concentration of high-severity flaws in one product within one patch cycle.

More concerning is the recent history of active exploitation. In the April 2026 Patch Tuesday cycle, a different SharePoint vulnerability, CVE-2026-32201, was confirmed as a zero day exploited in the wild. Recurring critical SharePoint vulnerabilities and demonstrated attacker interest are both reasons for organizations to treat SharePoint patching as a high-priority task.

The broader May 2026 Patch Tuesday addressed 120 vulnerabilities across the Microsoft ecosystem, though none were zero days exploited in the wild at the time of release.

References

• CVE-2026-33110: Microsoft Security Response Center Advisory
• CVE-2026-33110: NVD Entry
• KB5002863: SharePoint Server Subscription Edition Security Update
• KB5002870: SharePoint Server 2019 Security Update
• KB5002868: SharePoint Enterprise Server 2016 Security Update
• Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days (Bleeping Computer)
• Patch Tuesday May 2026 (PDQ)
• Microsoft's April 2026 Patch Tuesday Addresses 163 CVEs (Tenable)
• Microsoft's May 2026 Patch Tuesday (Tenable)
• The May 2026 Security Update Review (Zero Day Initiative)