{"id":"CVE-2026-120000","kind":"vulnerability","aliases":["CVE-2026-120000"],"related":[],"title":"Microsoft SharePoint: untrusted data deserialization lets an authorized user run code","description":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","summary":"Microsoft SharePoint deserializes untrusted data without proper checks, so an attacker with a valid account can run code over the network. The attacker gets code execution on the server that hosts the affected SharePoint component.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SharePoint Server Subscription Edition","fixed":[],"affected":"unknown","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","deserialization","on-prem","sharepoint","vendor","windows"],"not_affected_if":["auth-required","sharepoint-online"],"how_to_check":"Unknown until the MSRC advisory is read. Check your SharePoint Server build (Central Administration > Upgrade and Migration > Check product and patch installation status) against the fixed build in the MSRC entry for CVE-2026-120000. Rapid7 lists SharePoint Server Subscription Edition; also check 2019 and 2016 if you run them.","fix":"Unknown: install the November 2026 SharePoint Server security update once MSRC names the KB and build for CVE-2026-120000.","status":"open","published_at":"2026-11-10T19:20:25+00:00","first_seen_at":"2026-11-10T19:25:07+00:00","triaged_at":"2026-11-10T19:44:24+00:00","updated_at":"2026-11-10T22:08:08+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-11-10T19:44:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SharePoint: untrusted data deserialization lets an authorized user run code","impact":"high","summary":"Microsoft SharePoint deserializes untrusted data without proper checks, so an attacker with a valid account can run code over the network. The attacker gets code execution on the server that hosts the affected SharePoint component.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sharepoint","on-prem","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code on the SharePoint server","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-120000 for affected builds, fixed versions and patch, and confirm whether SharePoint Online is affected.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["sharepoint-online"],"who_is_affected":"Organizations running Microsoft SharePoint (Office SharePoint) on premises where users can authenticate to the server over the network. The sources do not state affected versions or the exact configuration required, so whether a given deployment is exposed is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00068,"input_tokens":4495,"output_tokens":461,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-120000 for affected builds, fixed versions and patch, and confirm whether SharePoint Online is affected.","search":"'-120000':14A,17A '-2026':13A,16A 'account':46B 'affect':64B 'allow':75C 'attack':42B,54B,78C 'auth':23B 'auth-requir':22B 'author':8A,77C 'check':39B 'code':11A,49B,56B,81C 'compon':66B 'cve':12A,15A 'data':4A,36B,70C 'deseri':5A,25B,34B,67C 'edition':21A 'execut':57B,80C 'get':55B 'host':62B 'let':6A 'microsoft':1A,32B,72C 'network':52B,84C 'offic':73C 'on-prem':26B 'prem':28B 'proper':38B 'requir':24B 'run':10A,48B 'server':19A,60B 'sharepoint':2A,18A,29B,33B,65B,74C 'subscription':20A 'untrust':3A,35B,69C 'user':9A 'valid':45B 'vendor':30B 'window':31B 'without':37B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft SharePoint (Office SharePoint) on premises where users can authenticate to the server over the network. The sources do not state affected versions or the exact configuration required, so whether a given deployment is exposed is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["serversubscriptionedition","sharepointserversubscriptionedition"],"ptokens":["edition","server","sharepoint","subscription"],"labels":["authrequired","deserialization","high","onprem","sharepoint","vendor","windows"],"campaign_type":null,"search_a":"'-120000':14A,17A '-2026':13A,16A 'author':8A 'code':11A 'cve':12A,15A 'data':4A 'deseri':5A 'edition':21A 'let':6A 'microsoft':1A 'run':10A 'server':19A 'sharepoint':2A,18A 'subscription':20A 'untrust':3A 'user':9A","search_b":"'account':46B 'affect':64B 'attack':42B,54B 'auth':23B 'auth-requir':22B 'check':39B 'code':49B,56B 'compon':66B 'data':36B 'deseri':25B,34B 'execut':57B 'get':55B 'host':62B 'microsoft':32B 'network':52B 'on-prem':26B 'prem':28B 'proper':38B 'requir':24B 'run':48B 'server':60B 'sharepoint':29B,33B,65B 'untrust':35B 'valid':45B 'vendor':30B 'window':31B 'without':37B","search_c":"'allow':75C 'attack':78C 'author':77C 'code':81C 'data':70C 'deseri':67C 'execut':80C 'microsoft':72C 'network':84C 'offic':73C 'sharepoint':74C 'untrust':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120000","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120000","severity":null,"published_at":"2026-11-10T19:20:25+00:00","modified_at":"2026-11-10T19:20:25+00:00","first_seen_at":"2026-11-10T19:25:07+00:00","fetched_at":"2026-11-10T19:25:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120000:2923","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120000","severity":null,"published_at":"2026-11-10T22:08:08+00:00","modified_at":"2026-11-10T22:08:08+00:00","first_seen_at":"2026-11-10T22:08:08+00:00","fetched_at":"2026-11-10T22:08:08+00:00","note":"MSRC page is JS-only and unreadable here (web-cli empty, browser quota out). Only NVD (CNA Microsoft, CVSS 7.5 AV:N/AC:H/PR:L, CWE-502) and Rapid7 (lists SharePoint Server Subscription Edition; a rewrite) read. Fixed builds/KB unknown; November 2026 Patch Tuesday (SecurityWeek: 27 SharePoint Server fixes) likely carries it, unconfirmed. Nothing verified. No exploitation or PoC seen.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-120000","https://www.rapid7.com/db/vulnerabilities/cve-2026-120000/"]}],"documents":[{"id":119400,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120000","title":"NVD CVE-2026-120000 (CNA: Microsoft)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":119402,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-120000/","title":"Rapid7 DB CVE-2026-120000","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}