This vulnerability (CVE-2026-48560) affects Microsoft SharePoint Enterprise Server 2016 version 16.0.0. It is caused by improper deserialization of untrusted data, which can be exploited by an authorized attacker to conduct spoofing attacks over a network. The CVSS v3.1 base score is 5.4, indicating medium severity, with attack vector network, low attack complexity, and requiring low privileges but no user interaction. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

An authorized attacker can exploit this vulnerability to perform spoofing attacks over a network, potentially misleading users or systems by impersonating legitimate entities. The confidentiality and integrity impacts are low, and availability is not affected. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users of Microsoft SharePoint Enterprise Server 2016 version 16.0.0 should apply the security update provided by Microsoft as detailed in their advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48560. Applying this patch mitigates the vulnerability.