CVE-2026-48560: SharePoint Deserialization Spoofing Vulnerability – CVSS 5.4

Technical summary

CVE-2026-48560 stems from improper handling of deserialized untrusted data in SharePoint (CWE-502), combined with a secondary cross-site scripting vector (CWE-79). An authenticated attacker can craft malicious serialized objects that, when processed by SharePoint, allow spoofing attacks over the network. The CVSS 3.1 score of 5.4 reflects network-exploitable conditions (AV:N) with low attack complexity (AC:L), requiring valid login credentials (PR:L), no user interaction (UI:N), and resulting in limited confidentiality and integrity impact (C:L/I:L/A:N).

Business impact

This vulnerability primarily threatens organizations where insider security posture is weak or where credential compromise is a realistic concern. An attacker with valid SharePoint access could impersonate users, forge communications, or subtly alter sensitive documents or metadata without detection if baseline user behavior monitoring is absent. For organizations leveraging SharePoint as a trusted collaboration platform for regulated content (healthcare, finance, legal), the ability to spoof user identity creates audit trail risks and potential compliance violations. The attack leaves minimal forensic indicators since it operates within authenticated sessions.

Affected systems

Microsoft SharePoint Server deployments are affected. Verify specific versions against the official Microsoft advisory, as the source data does not enumerate version numbers. Both on-premises and potentially hybrid deployments should be assessed. Cloud-hosted SharePoint Online may have different exposure; consult vendor guidance for SaaS-specific applicability.

Exploitability

Exploitation requires valid SharePoint credentials, making this a lower-risk vulnerability for organizations with strong access controls and privileged account monitoring. However, in environments with overly permissive SharePoint permissions or where service accounts have broad site-collection rights, exploitation potential rises significantly. No public exploit code or active exploitation in the wild is indicated by the absence of KEV listing. The network-exploitable vector (no VPN/firewall bypass needed) means any attacker with credentials can attempt the attack from any network location.

Remediation

Apply security updates from Microsoft as they become available. Prioritize patching production SharePoint environments where sensitive data or high-trust user populations exist. Interim controls include restricting SharePoint permissions to principle of least privilege, disabling unnecessary service accounts with broad access, and enabling detailed audit logging of user impersonation and metadata changes.

Patch guidance

Check the official Microsoft Security Update Guide and the SharePoint Server product security advisory page for affected versions and patch availability. Patches should be tested in a non-production environment before broad rollout, particularly given SharePoint's critical role in many enterprises. Verify patch applicability to your specific SharePoint version and any cumulative updates already applied. Consider scheduling patches during maintenance windows to minimize collaboration disruptions.

Detection guidance

Monitor SharePoint audit logs for: (1) unusual deserialization events or exceptions in ULS logs; (2) user spoofing indicators, such as document edits or site modifications attributed to users at unexpected times or locations; (3) cross-site scripting (XSS) payloads in SharePoint content or metadata; (4) service account or high-privilege account activity outside normal business hours. Implement alerting on rapid permission changes or group membership modifications that could indicate lateral movement post-compromise. Network-level detection is difficult since exploitation uses legitimate authenticated traffic.

Why prioritize this

Although scored MEDIUM severity, this vulnerability warrants prompt but not emergency remediation. The requirement for valid credentials significantly narrows the attack surface. However, the nature of the spoofing risk—allowing attackers to impersonate trusted users within a collaboration platform—creates elevated business risk for organizations handling sensitive or regulated data. Prioritize based on your environment's credential hygiene, the sensitivity of data stored in SharePoint, and the breadth of user permissions.

Risk score, explained

The CVSS 5.4 rating reflects a network-accessible vulnerability (AV:N) with low technical barriers (AC:L) that requires authentication (PR:L) but causes meaningful confidentiality and integrity loss (C:L/I:L). No availability impact (A:N) prevents a higher score. The vector indicates an attacker can operate remotely without special conditions, but only if they possess valid login credentials—a gate that keeps this from being critical.

Frequently asked questions