This vulnerability (CVE-2026-63514) in Microsoft SharePoint Enterprise Server 2016 is caused by improper deserialization of untrusted data, classified under CWE-502. It enables an attacker with authorized access to execute arbitrary code remotely, potentially leading to full compromise of the affected system. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required. Microsoft has published an official fix to address this vulnerability.

An authorized attacker can exploit this vulnerability remotely to execute arbitrary code on the affected SharePoint server. This can lead to complete compromise of confidentiality, integrity, and availability of the system. The high CVSS score reflects the critical impact on affected systems if exploited.

An official fix is available from Microsoft. Users should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63514 to remediate this vulnerability. No additional mitigations are specified by the vendor.