CVE-2026-45484

The 'authorized attacker' qualifier in this disclosure obscures a dangerous reality: in most enterprise environments, SharePoint deserialization flaws function as domain-admin shortcuts rather than simple privilege escalation. A low-privileged SharePoint user who can trigger a deserialization gadget chain isn't just moving vertically within the application — they're often moving laterally into infrastructure where the blast radius expands dramatically. SharePoint's tight Active Directory integration, its role as a trusted document repository, and its service account architecture aren't accidental; they're design choices that create a platform where any code execution is infrastructure compromise. The service account credentials can typically reach SQL Server with broad privileges, file shares used for document workflows, and backend systems that trust the service account implicitly. One successful chain detonates whatever else runs on that shared .NET runtime — a cascade vector the CVSS doesn't capture. The EPSS score of 0.35216 signals that threat intelligence systems are treating this as exploitation-imminent. This is precisely where organized threat actors differentiate themselves: they develop weaponized exploits during the 'no observed exploitation' window precisely because defender attention is lowest and patch compliance is incomplete. The historical pattern is predictable: CVE drops, EPSS rises based on exploitability characteristics, defenders wait for confirmation, and when intrusions surface months later in incident reports, the original CVE gets retroactively tagged as part of the kill chain. Deserialization vulnerabilities are uniquely dangerous because they're version-agnostic in a dangerous way. If a vulnerable library ships with SharePoint and an attacker identifies a working gadget chain, patch compliance becomes the only gatekeeper — not configuration, not network segmentation. When Microsoft patches a deserialization vector in SharePoint specifically, they're patching the specific gadget that makes their product the delivery mechanism; the underlying ysoserial-style chains remain viable because SharePoint's dependency tree ships with multiple gadget-capable libraries. Organizations that believe they're protected because they applied the CVE patch are protected against one known chain, not the class of attacks. Patch compliance lag in large SharePoint environments typically runs 2-6 weeks, and during that window the blast radius is fully active. The temporal gap converts vulnerability severity into actualized organizational risk. Treat this as a priority-one SharePoint patch regardless of the 'authorized' framing — the blast radius of a successful exploit extends well beyond the application itself, and the EPSS signal suggests the window for opportunistic exploitation is already open.

Reviewed through automated stages and approved by a human before publication.