Microsoft Office SharePoint contains a critical deserialization vulnerability that enables authenticated attackers to execute arbitrary code on the host server.

The flaw is a deserialization of untrusted data (CWE-502) that occurs when the application processes malicious input. An attacker with low privileges (authenticated) can leverage this vulnerability to gain remote code execution capabilities on the underlying server.

The potential for remote code execution represents a total compromise of the affected server, which may lead to unauthorized data access, lateral movement within the network, and complete system takeover. With a CVSS score of 8.8, this vulnerability is classified as High severity, reflecting the significant risk to confidentiality, integrity, and availability of business-critical SharePoint environments.

Immediate Action: Update all affected instances of Microsoft SharePoint to the versions specified in the Microsoft security update guide.

Proactive Monitoring: Review web server and application logs for unusual serialized objects or unexpected process execution patterns originating from authenticated user accounts.

Compensating Controls: Implement strict network segmentation to limit the exposure of SharePoint servers and ensure that only necessary traffic is permitted, which can reduce the attack surface for remote exploitation.

Public Exploit Available: Yes, a public proof-of-concept repository has been identified on GitHub.

Given the potential for remote code execution and the presence of a public proof-of-concept, organizations must prioritize the application of the vendor-supplied security patches. Administrators should verify their current build versions against the provided ranges and schedule maintenance windows immediately to eliminate this critical security gap.