This vulnerability (CVE-2026-45659) in Microsoft SharePoint Enterprise Server 2016 arises from improper handling of deserialization of untrusted data (CWE-502). An attacker with authorized access can exploit this flaw to execute arbitrary code remotely, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.8, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. Microsoft has published an official fix to remediate this vulnerability.

Successful exploitation allows an authorized attacker to execute arbitrary code remotely on the affected SharePoint server, potentially leading to full compromise of the system including confidentiality, integrity, and availability impacts. This could enable control over the server and access to sensitive data hosted on it.

An official fix is available from Microsoft. Administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659 promptly to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.