This vulnerability (CVE-2026-40357) affects Microsoft SharePoint Enterprise Server 2016 version 16.0.0. It is caused by improper deserialization of untrusted data, which can lead to remote code execution by an attacker with authorized access. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

Successful exploitation allows an authorized attacker to execute arbitrary code remotely on the affected SharePoint server, potentially leading to full compromise of confidentiality, integrity, and availability of the system. The vulnerability requires the attacker to have some level of privileges (PR:L) but does not require user interaction (UI:N).

An official fix is available from Microsoft. Administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40357 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor.