CVE-2026-105013 HIGH

CVE-2026-105013: Microsoft Office SharePoint Remote Code Execution Vulnerability

Vendor Microsoft
Product Microsoft SharePoint Server Subscription Edition
Weakness CWE-502 · Unsafe deserialization
Published October 13, 2026
Last update October 16, 2026
View on NVD All CVEs

CVSS base score

7.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:U/RL:O/RC:C

What the vulnerability does

01Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Key dates

02Disclosure timeline

October 13, 2026 CVE published
October 16, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-65572 WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability CVE-2026-59521 WordPress Real Testimonials plugin <= 3.1.15 - PHP Object Injection vulnerability CVE-2026-57738 WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability CVE-2026-12240 Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field CVE-2026-57724 WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability