Brief Summary: Microsoft SharePoint Server RCE via Deserialization (CVE-2026-40357)

Introduction

Microsoft's May 2026 Patch Tuesday addressed 120 flaws, and buried within that batch are six separate remote code execution vulnerabilities targeting SharePoint Server, all scored at CVSS 8.8. CVE-2026-40357 is one of two in that group that stem from insecure deserialization. Any authenticated user with basic Site Member permissions can use it to execute arbitrary code on the server over the network.

For organizations running on-premises SharePoint, this is a meaningful risk. The attack complexity is low, no user interaction is required, and the privilege bar is minimal. Combined with high impact on confidentiality, integrity, and availability, those factors make this vulnerability worth understanding and patching promptly.

Technical Information

Root Cause: CWE-502 Deserialization of Untrusted Data

CVE-2026-40357 is classified under CWE-502, Deserialization of Untrusted Data. The flaw is in how Microsoft Office SharePoint processes serialized data received from network requests. When SharePoint deserializes that data without adequate validation or sanitization, an attacker can craft a malicious serialized payload that triggers arbitrary code execution on the server as it is deserialized.

The vulnerable component is bound to the network stack, so exploitation does not require local access or adjacency to the target. It is remotely exploitable across one or more network hops.

CVSS Breakdown

The full CVSS 3.1 vector string is:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The individual metrics break down as follows:

Attack Flow

Based on the advisory details, exploitation follows this general sequence:

1. Authentication: The attacker obtains or already has valid credentials for the SharePoint environment. The minimum required privilege level is Site Member, a common, low-tier role in most SharePoint deployments.

2. Payload Construction: The attacker crafts a malicious serialized object designed to execute arbitrary commands when it is deserialized. The specific serialization format and endpoint are not publicly documented, but the CWE-502 classification confirms the deserialization pathway.

3. Network Delivery: The attacker sends the payload to the vulnerable SharePoint Server endpoint. No special network positioning or timing conditions are required (Attack Complexity: Low).

4. Deserialization and Execution: SharePoint Server processes the incoming request and deserializes the attacker-controlled data without sufficient validation. The embedded malicious code then runs on the server, and the impact is full compromise of confidentiality, integrity, and availability.

Broader Context: A Cluster of SharePoint Deserialization Flaws

CVE-2026-40357 arrived alongside five other SharePoint RCE vulnerabilities in the May 2026 patch cycle, all with a CVSS score of 8.8:

Two deserialization flaws (CVE-2026-35439 and CVE-2026-40357) in the same patch cycle suggest a systemic pattern in how SharePoint handles serialized data, rather than an isolated coding error.

Patch Information

Microsoft released official patches for CVE-2026-40357 on May 12, 2026, as part of the May 2026 Patch Tuesday cycle. The fix addresses how SharePoint handles deserialized data from untrusted sources and hardens the server-side processing pipeline against malicious payloads.

Microsoft published three security updates, one for each supported SharePoint Server edition:

Each KB package is cumulative. The Subscription Edition update (KB5002863) also addresses CVE-2026-33112, CVE-2026-33110, CVE-2026-40368, and CVE-2026-35439. The SharePoint Server 2019 update (KB5002870) covers other CVEs as well, including CVE-2026-40367 and CVE-2026-40365. Administrators should treat these as comprehensive rollups rather than single-vulnerability patches.

Installation Methods

Each update can be installed in three ways:

1. Microsoft Update: Automatic delivery when auto update is enabled.
2. Microsoft Update Catalog: Standalone packages available for manual download (e.g., catalog entry for KB5002863).
3. Microsoft Download Center: Direct download links such as KB5002863 for Subscription Edition and KB5002870 for SharePoint 2019.

Prerequisites and Caveats

If the environment runs SharePoint Workflow Manager, administrators must install KB5002799 (the November 2025 Workflow Manager update) before applying any of these May 2026 cumulative updates. Skipping that step could break workflow functionality.

Environments still running the Classic version of Workflow Manager must enable a debug flag via PowerShell and run iisreset to maintain compatibility:

$farm.ServerDebugFlags.Add(53601)
iisreset

Integrity Verification

The SHA-256 hash for the Subscription Edition package is:

E2B144E8C5F7F85F147EA3B553E5D5487685741D96E7E5E1951F0EC9AAF4BF20

Administrators can use it to verify the download before deployment.

No alternative workarounds are listed for this vulnerability. Applying the official patches is the only endorsed remediation path.

Affected Systems and Versions

These on-premises SharePoint Server editions are confirmed vulnerable:

Any installation running a build below the listed target is vulnerable and needs the corresponding KB update. The advisories cover on-premises server editions only. The available materials do not document whether Microsoft had to patch SharePoint Online environments on the backend.

Vendor Security History

SharePoint Server accumulated six remote code execution vulnerabilities in the May 2026 patch cycle alone, all with the same CVSS score of 8.8. Two of the six involve deserialization of untrusted data (CVE-2026-40357 and CVE-2026-35439), which points to a concentrated weakness in SharePoint's serialization handling. The pattern suggests that security researchers and Microsoft's internal teams are actively auditing this attack surface, and organizations should expect more deserialization-related fixes in future patch cycles.

The May 2026 Patch Tuesday addressed 120 flaws in total across Microsoft's product portfolio, with no zero-days reported. The current exploitability assessment for CVE-2026-40357 is "Exploitation Less Likely," but a cluster of similar vulnerabilities in one release makes it more likely that threat actors will reverse engineer the patches to find exploitable code paths.

References

• CVE-2026-40357: Microsoft Security Update Guide
• CVE-2026-40357: NVD Detail
• CVE Record: CVE-2026-40357
• KB5002863: Security Update for SharePoint Server Subscription Edition
• KB5002870: Security Update for SharePoint Server 2019
• KB5002868: Security Update for SharePoint Enterprise Server 2016
• Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days (BleepingComputer)
• Patch Tuesday May 2026 (Action1)
• Patch Tuesday May 2026 (PDQ)
• Microsoft Update Catalog: KB5002863
• Microsoft Download Center: KB5002863 for Subscription Edition
• Microsoft Download Center: KB5002870 for SharePoint 2019