Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to have a deep understanding of the system. Successful exploitation is not guaranteed and depends on a combination of factors that might include the environment, system configuration, and the presence of additional security measures.
According to the CVSS metric, low privileges are required (PR:L). What privileges are required?
An attacker must have an authenticated SharePoint account with permission to add content and personalize an existing page. Farm administrator permissions are not required.
Security updates
16.0.20326.20278 — https://support.microsoft.com/help/5002945
Vulnerabilities 1
-
High 7.5
Microsoft Office SharePoint Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-120000 Microsoft Office SharePoint Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120000
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss