{"id":"CVE-2026-123390","kind":"vulnerability","aliases":["CVE-2026-123390"],"related":[],"title":"Microsoft SharePoint: untrusted data deserialization lets an authorized user run code","description":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","summary":"Microsoft SharePoint mishandles untrusted serialized data, so an attacker with a valid account can run code over the network. NVD rates it high (CVSS 8.8).","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft-office","on-premises","sharepoint","vendor"],"not_affected_if":["sharepoint-online"],"how_to_check":"- Check the installed SharePoint build against the version list in the Microsoft Security Response Center entry for CVE-2026-123390","fix":null,"status":"open","published_at":"2026-11-10T19:20:42+00:00","first_seen_at":"2026-11-10T19:25:12+00:00","triaged_at":"2026-11-10T19:26:20+00:00","updated_at":"2026-11-10T19:26:20+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-11-10T19:26:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SharePoint: untrusted data deserialization lets an authorized user run code","impact":"high","summary":"Microsoft SharePoint mishandles untrusted serialized data, so an attacker with a valid account can run code over the network. NVD rates it high (CVSS 8.8).","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sharepoint","microsoft-office","on-premises"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs on the SharePoint server by an authorized user","analyst_note":"Confirm affected SharePoint versions and the Microsoft advisory for CVE-2026-123390 at https://nvd.nist.gov/vuln/detail/CVE-2026-123390.","how_to_check":"- Check the installed SharePoint build against the version list in the Microsoft Security Response Center entry for CVE-2026-123390\n- unknown for specific file paths or settings, the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["sharepoint-online"],"who_is_affected":"Organizations running Microsoft SharePoint Server on premises, where an authorized user can reach the affected deserialization path over the network. The sources do not name specific versions, configurations or SharePoint Online status. Teams using only SharePoint Online can likely skip it, but the sources do not confirm this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":4495,"output_tokens":538,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected SharePoint versions and the Microsoft advisory for CVE-2026-123390 at https://nvd.nist.gov/vuln/detail/CVE-2026-123390.","search":"'-123390':14A,17A '-2026':13A,16A '8.8':50B 'account':38B 'allow':59C 'attack':34B,62C 'author':8A,61C 'code':11A,41B,65C 'cve':12A,15A 'cvss':49B 'data':4A,31B,54C 'deseri':5A,51C 'execut':64C 'high':48B 'let':6A 'microsoft':1A,19B,26B,56C 'microsoft-offic':18B 'mishandl':28B 'network':44B,68C 'nvd':45B 'offic':20B,57C 'on-premis':21B 'premis':23B 'rate':46B 'run':10A,40B 'serial':30B 'sharepoint':2A,24B,27B,58C 'untrust':3A,29B,53C 'user':9A 'valid':37B 'vendor':25B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft SharePoint Server on premises, where an authorized user can reach the affected deserialization path over the network. The sources do not name specific versions, configurations or SharePoint Online status. Teams using only SharePoint Online can likely skip it, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","microsoftoffice","onpremises","sharepoint","vendor"],"campaign_type":null,"search_a":"'-123390':14A,17A '-2026':13A,16A 'author':8A 'code':11A 'cve':12A,15A 'data':4A 'deseri':5A 'let':6A 'microsoft':1A 'run':10A 'sharepoint':2A 'untrust':3A 'user':9A","search_b":"'8.8':50B 'account':38B 'attack':34B 'code':41B 'cvss':49B 'data':31B 'high':48B 'microsoft':19B,26B 'microsoft-offic':18B 'mishandl':28B 'network':44B 'nvd':45B 'offic':20B 'on-premis':21B 'premis':23B 'rate':46B 'run':40B 'serial':30B 'sharepoint':24B,27B 'untrust':29B 'valid':37B 'vendor':25B","search_c":"'allow':59C 'attack':62C 'author':61C 'code':65C 'data':54C 'deseri':51C 'execut':64C 'microsoft':56C 'network':68C 'offic':57C 'sharepoint':58C 'untrust':53C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123390","severity":null,"published_at":"2026-11-10T19:20:42+00:00","modified_at":"2026-11-10T19:20:42+00:00","first_seen_at":"2026-11-10T19:25:12+00:00","fetched_at":"2026-11-10T19:25:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}