CVE-2026-64901

Think of SharePoint like a building with secure doors, where only certain staff can enter. This bug lets an attacker who has low-level access to the building “trick” SharePoint into handling malicious input in a way that can make the server run their code—without needing anyone to click or do anything. If it’s reachable from the attacker’s side, it can lead to the whole server being controlled, including access to files and services.

This matters if your organization runs Microsoft SharePoint Server, including Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition. The risk is highest when an attacker can gain low-level permissions (since low privileges are enough) and the vulnerable functionality can be reached over the network. There’s no requirement for a user to click a link for this issue.

This should be treated as RED priority because the vulnerability enables remote code execution with full impact on the server (confidentiality, integrity, and availability). Even though public exploit code and confirmed incidents are not shown in the findings, the flaw design requires only low-level authorization and no user interaction—making it attractive to attackers once they have access.

1. Confirm exposure (what you run):

   • Identify which product you have: Microsoft SharePoint Server, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition.
   • Record the installed SharePoint build/version.

2. Determine whether you’re affected:

   • Compare your current SharePoint build/version to the Microsoft fixed versions for CVE-2026-64901.
   • If your build is older than the fixed build for your specific edition, you should assume you are affected.

3. Patch with the correct fixed versions (per edition):

   • SharePoint Server and Microsoft SharePoint Server Subscription Edition: fixed in 16.0.19725.20522
   • Microsoft SharePoint Enterprise Server 2016: fixed in 16.0.5565.1001
   • Microsoft SharePoint Server 2019: fixed in 16.0.10417.20198

4. Upgrade procedure notes:

   • Follow Microsoft’s update guidance for CVE-2026-64901 using the Microsoft Update Guide link.
   • Plan for an appropriate maintenance window as SharePoint security updates may require service restarts.

5. If patching is delayed (temporary containment):

   • Limit who can access SharePoint using low-level permissions (reduce the number of accounts with the permissions level required by the threat scenario).
   • Restrict external network exposure to SharePoint wherever feasible (for example, avoid unnecessary direct internet access).

6. After patching:

   • Verify the SharePoint build/version reflects the updated fixed version.
   • Review relevant server logs/alerts for unusual activity around SharePoint processing pathways (focus on activity that looks like attempts to provide crafted inputs to the server).

7. Timing expectation:

   • The findings do not provide a CISA due date for this CVE, and KEV listing was not reported.
   • Given the RED verdict, prioritize scheduling the update immediately in your next maintenance window.

CVE-2026-64901 is a Microsoft SharePoint Server remote code execution issue mapped to CWE-502. The mechanism described in the findings is that an attacker with low-level permissions can trick the server into processing unsafe/untrusted data, resulting in arbitrary code execution over the network without requiring user interaction. This is consistent with the backstop description of deserialization of untrusted data.

Findings summary for operational risk:

• Authentication level: low privileges (attacker must be authorized with low permissions).
• User interaction: none required.
• Exploitation: no KEV listing reported; no public exploit code recorded; no confirmed incidents found in the provided news/press findings.
• Patch availability: Microsoft has published fixed builds (16.0.19725.20522 for SharePoint Server and Subscription Edition; 16.0.5565.1001 for SharePoint Enterprise Server 2016; 16.0.10417.20198 for SharePoint Server 2019).
• Targeting signal: PULSE indicates patch-focused attention and names the Lazarus group as an actor associated with observed activity.

Verdict rationale alignment: despite the lack of public exploit code and no KEV/news-confirmed incidents in the provided findings, the capability for full server compromise with network reachability and low authorization requirements makes this a high-priority remediation item (RED).