CVE-2026-85900

Executive Summary

CVE-2026-85900 is a deserialization-of-untrusted-data vulnerability (CWE-502) in Microsoft Office SharePoint that permits an authenticated, network-positioned attacker to execute arbitrary code on the SharePoint server. The flaw carries a CVSS v3.1 base score of 8.8 (High), reflecting low attack complexity, no user interaction, and high confidentiality, integrity, and availability impact, tempered only by the requirement for low-privilege authentication (PR:L). No patch, vendor advisory detail, public proof-of-concept, Nuclei template, or CISA KEV entry currently exists for this CVE, leaving affected deployments exposed until Microsoft publishes remediation guidance.

Technical Analysis

The vulnerability class is CWE-502, Deserialization of Untrusted Data. In this class of flaw, an application accepts serialized data from a source it does not fully trust and reconstructs live objects from that data without adequate type restriction or integrity validation. Where the underlying runtime permits attacker-controlled type instantiation during deserialization — a well-documented pattern in .NET, Java, and PHP object-serialization formats — the attacker can influence which types are constructed and which methods execute during object reconstruction. This frequently yields remote code execution without a separate memory-corruption primitive, because the deserialization pipeline itself invokes attacker-selected behavior.

SharePoint is a widely deployed, internet-facing collaboration platform whose feature set (web parts, workflows, business data connectivity, site provisioning, and assorted administrative endpoints) has historically contained multiple serialization-based code execution issues. That architectural context is consistent with the NVD description and CVSS vector, but the specific vulnerable component, endpoint, serialized format, and object-graph gadget chain are not enumerated in the data provided for this CVE. No CWE sub-category, source file, assembly name, or API parameter is published. Any statement naming a specific SharePoint method, endpoint, or assembly for this CVE would be speculation and is therefore omitted.

What can be stated with confidence from the vector and description: the attack surface is reachable over the network (AV:N), requires no victim interaction (UI:N), is trivially repeatable given valid low-privileged credentials (AC:L, PR:L), and terminates in full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) with scope unchanged (S:U) — meaning the vulnerable SharePoint component's compromise does not formally cross an authorization boundary in the CVSS model, though code execution on an application server typically does so in practice.

Microsoft SharePoint deployments frequently run under service accounts with broad read/write access to content databases and, in many enterprises, with Kerberos delegation or access to adjacent systems. A code-execution foothold at the web application tier therefore provides a strong platform for lateral movement, data exfiltration from document libraries, and persistence via legitimate SharePoint extensibility surfaces.

Exploitation maturity as of this report: no public exploit code, no PoC, no Nuclei template, and no observed in-the-wild exploitation reported by tracked sources.

Exploitation Scenarios

The following attack chain is derived strictly from the NVD description ("deserialization of untrusted data ... allows an authorized attacker to execute code over a network") and the CVSS vector. No public PoC is available; the chain is inferred at the vulnerability-class level. No specific endpoints, parameters, or method names are asserted because none are published for this CVE.

1. Reconnaissance and target identification. The attacker identifies internet- or intranet-reachable SharePoint front ends. Because the vulnerability requires authentication (PR:L), the attacker first obtains low-privileged credentials — through phishing, credential stuffing, password spraying against a federated or on-premises identity provider, purchase from an initial-access broker, or abuse of an existing unprivileged account. Public fingerprinting of SharePoint deployments (host headers, product identifiers in responses, login page characteristics) supports target selection.

2. Triggering the deserialization flaw. With a low-privileged session established, the attacker locates an input surface that accepts serialized data and passes it to an object-reconstruction routine without type allow-listing or integrity verification. Per CWE-502, the malformed serialized payload is crafted so that object reconstruction causes the runtime to instantiate attacker-chosen types and invoke methods on them. The specific SharePoint feature, endpoint, and serialization format for CVE-2026-85900 are not disclosed in the available data.

3. Payload and execution. The attacker submits the crafted serialized object over the network to the vulnerable routine. During deserialization, the runtime executes the attacker's chosen construction/method chain, resulting in arbitrary code execution in the security context of the SharePoint application pool identity. The attacker does not need to corrupt memory or bypass an interactive prompt; the deserialization callback path performs the work. No user interaction is required (UI:N).

4. Post-exploitation impact. With code execution as the SharePoint service account, the attacker can read and modify SharePoint content databases and document libraries (C:H/I:H), deploy or alter application-tier artifacts, establish persistence within the SharePoint/web server tier, harvest credentials and tokens accessible to the service identity, and pivot toward internal systems reachable from the SharePoint host. Denial of service is achievable by terminating or destabilizing the application pool (A:H). Because scope is recorded as unchanged, the CVSS model treats impact as confined to the vulnerable component, though operational reality in most enterprises favors rapid lateral movement.

Impact Assessment

Business impact is high. SharePoint is a primary repository for enterprise documents, intranet content, workflows, and often sensitive business data; code execution at the application tier exposes that content in bulk, not merely a single record set. With full C:H, I:H, and A:H subscores, an attacker can exfiltrate, tamper with, or destroy data and can render the collaboration platform unavailable.

The PR:L precondition meaningfully narrows the attacker population compared with a pre-authentication flaw, but not enough to be reassuring: any valid low-privileged account — including guest access where enabled, contractor accounts, or compromised end-user credentials — suffices. AC:L indicates no unusual conditions or race windows are needed, so once credentials are in hand, exploitation is straightforward and repeatable. UI:N means no employee needs to click anything for the exploit to fire, removing the most common human mitigation layer.

Blast radius considerations: internet-facing SharePoint farms are the highest-risk exposure, followed by extranet/partner-facing deployments, then internal-only farms that are still reachable by any authenticated internal user. On-premises SharePoint is the assumed target of the string "Microsoft Office SharePoint"; SharePoint Online / Microsoft 365 is a cloud service where Microsoft would remediate server-side and where customers have no patching action, but the CVE record does not distinguish deployment models, so both should be treated as potentially in scope until vendor clarification is available.

Compounding factors: patch confidence is 0/4 with no vendor fix, no workaround, and no affected-version enumeration. This means defenders cannot currently rely on a version-based scoping exercise and must treat the risk as open-ended. Absence of EPSS scoring, absence of KEV listing, and absence of public exploit code suggest exploitation is not yet widespread — but the same absence of a patch means a single public PoC release could convert this into a mass-exploitation event with little warning. Vulnerability-class precedent (deserialization RCE in enterprise collaboration platforms) is exactly the profile that historically attracts both ransomware affiliates and state-aligned actors once weaponized.

Detection Guidance

Sigma Rule

title: Suspicious SharePoint Deserialization Activity (CVE-2026-85900)
id: 6e2f1a44-9c1b-4f0e-b7d2-1a5c8e93b701
status: experimental
description: Detects anomalous process creation and web-application-pool child processes consistent with deserialization-based code execution on a SharePoint server.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85900
author: valtersit.com Threat Intelligence
date: 2026-01-01
tags:
  - attack.t1190
  - attack.execution
  - cve.2026.85900
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
  selection_suspicious_cmdline:
    CommandLine|contains:
      - 'FromBase64String'
      - 'System.Runtime.Serialization'
      - 'BinaryFormatter'
      - 'ObjectStateFormatter'
      - 'LosFormatter'
      - 'NetDataContractSerializer'
      - 'SoapFormatter'
      - 'IEX'
      - 'DownloadString'
  condition: selection_parent and (selection_child or selection_suspicious_cmdline)
falsepositives:
  - Legitimate SharePoint farm maintenance scripts and timer jobs
  - Administrative PowerShell run from a SharePoint management shell wrapper
level: high

YARA Rule

rule CVE_2026_85900_SharePoint_Deserialization_Payload
{
    meta:
        description = "Detects serialized-object payload markers associated with deserialization of untrusted data (CWE-502) in Microsoft SharePoint (CVE-2026-85900)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85900"
        date = "2026-01-01"
        severity = "high"

    strings:
        $fmt1 = "__type" ascii nocase
        $fmt2 = "BinaryFormatter" ascii nocase
        $fmt3 = "ObjectStateFormatter" ascii nocase
        $fmt4 = "LosFormatter" ascii nocase
        $fmt5 = "NetDataContractSerializer" ascii nocase
        $fmt6 = "System.Runtime.Serialization" ascii nocase
        $fmt7 = "AAEAAAD/////" ascii
        $fmt8 = "TypeConfuseDelegate" ascii nocase
        $fmt9 = "ObjectDataProvider" ascii nocase
        $fmt10 = "WorkflowFoundation" ascii nocase
        $b64ish = /[A-Za-z0-9+\/]{200,}={0,2}/ ascii

    condition:
        3 of ($fmt*) or (2 of ($fmt1, $fmt2, $fmt3, $fmt4, $fmt5) and $b64ish)
}

Suricata IDS Rule

alert http $HOME_NET any -> $HOME_NET any ( \
  msg:"CVE-2026-85900 Possible Microsoft SharePoint Deserialization of Untrusted Data Attempt"; \
  flow:established,to_server; \
  http.method; content:"POST"; \
  http.content_type; content:"application/octet-stream"; \
  http.request_body; content:"__type"; nocase; \
  http.request_body; content:"System.Runtime.Serialization"; nocase; \
  http.request_body; content:"BinaryFormatter"; nocase; \
  threshold: type both, track by_src, count 5, seconds 60; \
  classtype:web-application-attack; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85900; \
  metadata:cve CVE-2026-85900; \
  sid:2026859001; rev:1; \
  priority:1; )

Elastic Detection

process where event.type == "start" and
  process.parent.name : "w3wp.exe" and
  process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe",
                  "wscript.exe", "mshta.exe", "rundll32.exe", "certutil.exe")

Splunk SPL Query

index=windows source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent=lower(ParentImage), child=lower(Image), cmdline=lower(CommandLine)
| where (like(parent,"%w3wp.exe%") AND (like(child,"%cmd.exe%") OR like(child,"%powershell.exe%") OR like(child,"%cscript.exe%") OR like(child,"%mshta.exe%") OR like(child,"%rundll32.exe%") OR like(child,"%certutil.exe%")))
| append [
    search index=w3svc OR index=iis (status=200 OR status=500) uri_path=*
    | eval body=lower(coalesce(request_body, cs_uri_query, ""))
    | where match(body,"__type") AND (match(body,"binaryformatter") OR match(body,"objectstateformatter") OR match(body,"losformatter") OR match(body,"system\.runtime\.serialization"))
  ]
| table _time host user parent child cmdline uri_path status
| sort - _time

Wazuh OSSEC Rule

<group name="windows,sharepoint,cve-2026-85900,">
  <rule id="2026859" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">w3wp\.exe$</field>
    <field name="win.eventdata.image">(cmd|powershell|pwsh|cscript|wscript|mshta|rundll32|certutil)\.exe$</field>
    <description>CVE-2026-85900: Possible SharePoint deserialization RCE - suspicious child process spawned by IIS worker process</description>
    <mitre>
      <id>T1190</id>
      <id>T1059</id>
    </mitre>
    <group>attack,execution,</group>
  </rule>

  <rule id="2026860" level="10">
    <if_sid>31100</if_sid>
    <id>^POST$</id>
    <match>__type|BinaryFormatter|ObjectStateFormatter|LosFormatter|System\.Runtime\.Serialization</match>
    <description>CVE-2026-85900: Serialized-object payload markers observed in HTTP POST to SharePoint web tier</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, no affected-version range, no workaround, and no OSV package data exist in any tracked source. The guidance below is therefore hardening and containment oriented rather than patch oriented, and must be revisited as soon as Microsoft publishes an advisory or security update.

1. Immediate mitigations

• Restrict authenticated access. Because exploitation requires only low-privileged credentials (PR:L), treat identity controls as the primary containment layer: enforce MFA on all SharePoint-authenticated accounts, disable or tightly govern guest/external sharing, revoke stale and service accounts, and audit for accounts with more access than their role requires.
• Reduce network exposure. Place SharePoint behind a reverse proxy or WAF, restrict direct internet exposure of central administration and application-tier endpoints, and require VPN or zero-trust access for administrative and internal-only farm surfaces. Restrict farm-to-farm and server-to-server communication to required paths only.
• Tighten the application pool identity. Apply least privilege to the SharePoint service account, remove interactive logon rights where feasible, and limit its file-system and remote-access reach. This does not prevent exploitation but directly constrains post-exploitation movement.
• Monitor aggressively. Deploy and tune the detection content above; deserialization RCE often manifests as an anomalous child process of the web worker process, which is high-fidelity in most SharePoint environments.
• Preserve evidence. Enable detailed IIS and Windows process/command-line logging before any suspected incident so post-incident scoping is possible.

2. Patch / upgrade steps

• There is currently no patch to apply. Establish a watch process on the Microsoft Security Response Center (MSRC) update guide and the Microsoft SharePoint security update release notes. When a fix ships, prioritize internet-facing and extranet farms first, then internal farms, and test in a representative staging farm.
• Do not rely on version-based scoping, because no affected version range has been published for this CVE. Assume all supported on-premises SharePoint versions remain candidates until Microsoft states otherwise, and confirm whether the advisory applies to SharePoint Subscription Edition, SharePoint Server 2019/2016, or additional products.
• If Microsoft later publishes a configuration-based workaround (for example, disabling or restricting a specific feature), apply it immediately on internet-facing farms while planning the full update.

3. Long-term hardening

• Adopt a defense-in-depth posture for deserialization risk: prefer serialization formats with strict type allow-listing, and treat any component that reconstructs objects from network-supplied data as a trust boundary requiring validation.
• Maintain an inventory of internet-facing SharePoint farms with owner, data classification, and authentication model, and enforce a routine patch cadence that prioritizes externally reachable collaboration platforms.
• Segment the SharePoint application tier from high-value internal networks, and require privileged-access workstations for farm administration.
• Continuously monitor for exploit development. The absence of a public PoC today is not a durable condition; track NVD, MSRC, EPSS, and CISA KEV so that reassessment and emergency patching can begin on the day weaponization appears.

References

• NVD — CVE-2026-85900: https://nvd.nist.gov/vuln/detail/CVE-2026-85900
• CWE-502, Deserialization of Untrusted Data: https://cwe.mitre.org/data/definitions/502.html
• Microsoft Security Response Center (MSRC) Security Update Guide — primary source for the eventual SharePoint fix: https://msrc.microsoft.com/update-guide
• Microsoft SharePoint security update release notes: https://support.microsoft.com/ (SharePoint security update release notes)
• FIRST EPSS (no score currently assigned to this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-85900 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor and exploit-in-the-wild status: no exploitation campaigns, no public proof-of-concept, no exploit code, and no CISA KEV listing are associated with CVE-2026-85900 in the available data. Detection content in this report targets the vulnerability class (CWE-502) and the documented attack model rather than a confirmed exploit signature; it should be validated against environment baselines before production alerting.