Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-33112: SharePoint XmlValidator Bypass Enables Low-Privilege RCE

blog.viettelcybersecurity.com | vulnerability | CVE-2026-33112 | #rce | #deserialization | #sharepoint | #xml | #cve-2026-33112 | #performancepoint

Summary

CVE-2026-33112: a network-imported XSD schema bypasses SharePoint's XmlValidator, and the PerformancePoint PPSAuthoringService revives ExcelDataSet deserialization for low-privilege RCE.
Published
Collected

original ↗

Related coverage

  1. SharePoint ToolShell – One Request PreAuth RCE Chain (blog.viettelcybersecurity.com)
  2. SharePoint Unknown CVE Unveiled: RCE via WebPart Properties Deserialization (blog.viettelcybersecurity.com)
  3. Phân tích lỗ hổng CVE-2022-22005 Microsoft Sharepoint RCE (blog.viettelcybersecurity.com)
  4. CVE-2026-20963 Analysis (blog.viettelcybersecurity.com)
  5. CVE-2026-55040: SharePoint Server Subscription Edition improper JWT validation lead to Arbitrary Account Login (blog.viettelcybersecurity.com)
  6. CVE-2022-21587 (Oracle E-Business Suite Unauthenticated RCE) (blog.viettelcybersecurity.com)

back