This vulnerability (CVE-2026-50522) affects Microsoft SharePoint Enterprise Server 2016 version 16.0.0. It stems from improper handling of untrusted serialized data, which can be exploited by an attacker over the network to execute arbitrary code remotely. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and complete compromise of confidentiality, integrity, and availability. Microsoft has released an official fix to address this deserialization flaw.

Successful exploitation allows remote code execution by an unauthenticated attacker, potentially leading to full system compromise including data theft, modification, or denial of service. The vulnerability affects core SharePoint server functionality, impacting confidentiality, integrity, and availability of the affected system.

An official fix is available from Microsoft. Administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522 promptly to remediate this vulnerability.