This vulnerability (CVE-2026-40365) affects Microsoft SharePoint Enterprise Server 2016 version 16.0.0. It is caused by insufficient granularity of access control related to deserialization of untrusted data, enabling an authorized attacker to execute arbitrary code over a network. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required. Microsoft has released an official fix to address this issue.

Exploitation of this vulnerability could allow an authorized attacker to execute arbitrary code remotely on the affected SharePoint server, potentially leading to full compromise of the system with high confidentiality, integrity, and availability impact. No known exploits in the wild have been reported at this time.

An official fix is available from Microsoft. Users should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40365 to remediate this vulnerability.