This vulnerability (CVE-2026-33110) affects Microsoft SharePoint Enterprise Server 2016 (version 16.0.0) and is classified as CWE-502: Deserialization of Untrusted Data. It enables an attacker with authorized access to execute arbitrary code remotely by exploiting improper deserialization of data. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix to address this vulnerability.

Successful exploitation allows an authorized attacker to execute arbitrary code remotely on the affected SharePoint server, potentially leading to full compromise of the system's confidentiality, integrity, and availability. This could result in unauthorized data access, modification, or denial of service.

An official fix is available from Microsoft. Administrators should apply the provided security update from the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33110 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.