Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
In plain language
Written by AI from the record
CVE-2026-66808 is a SharePoint Server bug that lets an attacker with a basic login run commands on your server over the network, and it is reachable in default setups—if you use SharePoint Server 2016/2019/Subscription Edition, you should patch.
CVE-2026-66808 is a remote code execution issue caused by improper handling of serialized/untrusted data in Microsoft SharePoint Server; it can be triggered over the network by an attacker using low-privilege authenticated access and crafted data that causes the server to execute unintended commands.
If you're affected
Full server takeover
Malware deployment risk
Business disruption
Data theft from SharePoint
What is it
This vulnerability is like a “bad handshake” where SharePoint can be tricked into treating attacker-controlled data as something trustworthy. If someone has a basic user account, they can send the right kind of data to cause SharePoint to run attacker commands on the server.
In plain terms: it raises the risk that an attacker could get control of your SharePoint server, install harmful software, and disrupt your business or access documents.
Who is affected
This matters if your business runs Microsoft SharePoint Server (including SharePoint Enterprise Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition) and it’s reachable in your normal configuration.
The risk is specific: the attacker must already have valid login credentials for a low-privilege account and must know how to craft the malicious data—there is no need for you to click anything.
How urgent is it
This is RED because the bug allows remote code execution and is reachable in default configurations, meaning attackers don’t need special network access patterns. In addition, a known threat actor (Lazarus group) is associated with the activity and the fix is already available.
Act now to reduce the chance that a compromised or misused account could be used to take over your SharePoint server.
What to do — in detail
Confirm whether you’re affected
Identify the exact SharePoint Server edition and build number.
Compare your current version/build to the fixed versions for CVE-2026-66808:
sharepoint server (and Subscription Edition): fixed in 16.0.19725.20522
Microsoft SharePoint Enterprise Server 2016: fixed in 16.0.5565.1001
Microsoft SharePoint Server 2019: fixed in 16.0.10417.20198
Patch / upgrade
If your build is below the fixed version for your edition, apply the official Microsoft update for CVE-2026-66808.
After patching, re-check the SharePoint build number to confirm it matches the fixed target for your edition.
If you can’t patch immediately (temporary risk reduction)
Reduce the chance of credential misuse: review and tighten SharePoint account access (especially any low-privilege accounts), and disable or remove unused accounts.
Strengthen monitoring: check SharePoint/server authentication logs for abnormal login patterns (new geo/IP locations, unusual times, repeated failures followed by success).
Limit exposure: ensure SharePoint is not unnecessarily exposed to the public internet beyond what your business requires (this vulnerability is reachable in default configuration, so minimizing exposure lowers overall risk).
What to monitor after remediation
Continue watching for suspicious logins and unexpected server activity after the update.
If you find signs of compromise (unexpected admin actions, unusual file changes, new scheduled tasks/services), escalate incident response immediately.
KEV / exploitation notes
CISA KEV is not listed for this CVE based on the provided findings.
There is no clear dated public press claim of exploitation in the provided findings, and no public exploit code is on record; however, the vulnerability’s authentication requirements and remote code execution impact make timely patching important.
(Use the Microsoft update guide for the definitive installation details.)
Technical context
CVE-2026-66808 is a high-impact remote code execution issue (CWE-502: deserialization of untrusted data) in Microsoft SharePoint Server. The mechanism involves the server processing attacker-influenced serialized/untrusted data in a way that allows arbitrary code execution.
Key characteristics from the findings:
Remote/network attack path with no user interaction.
Requires authorized access: an attacker must have a valid low-privilege account token.
Reachability in default configurations: yes.
Exploitation maturity: no public exploit code was found in the provided findings; KEV is not listed.
Actor/telemetry note: the PUSH/PULSE data associates the activity with Lazarus group.
Patch status:
Fixed versions are provided per edition (see what_to_do and fix list in this record).
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
