Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
How could an attacker exploit this vulnerability?
An authenticated attacker with Site Member permissions on an affected SharePoint site could send a specially crafted request over the network. Successful exploitation could allow the attacker to execute code on the affected SharePoint server. No user interaction is required.
Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
Security updates
16.0.20326.20278 — https://support.microsoft.com/help/5002945
Vulnerabilities 1
-
High 8.8
Microsoft Office SharePoint Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-110044 Microsoft Office SharePoint Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110044
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss