PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-33112: SharePoint XmlValidator Bypass Enables Low-Privilege RCE

blog.viettelcybersecurity.com | vulnerability | CVE-2026-33112 | #rce | #deserialization | #sharepoint | #xml | #cve-2026-33112 | #performancepoint
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CVE-2026-33112: a network-imported XSD schema bypasses SharePoint's XmlValidator, and the PerformancePoint PPSAuthoringService revives ExcelDataSet deserialization for low-privilege RCE.
CVE
CVE-2026-33112
Published
Collected

Related coverage

vulnerability · blog.viettelcybersecurity.com
Phân tích CVE-2026-20963
A diff-based analysis of SharePoint CVE-2026-20963 shows the KB5002825 patch hardened Register Directive parsing, which attackers could abuse to bypass SafeControls checks and reach RCE.
vulnerability · blog.viettelcybersecurity.com
SharePoint ToolShell – One Request PreAuth RCE Chain
The Pwn2Own Berlin 2025 ToolShell chain combines a ToolPane authentication bypass (CVE-2025-49706) and DataSetSurrogateSelector deserialization (CVE-2025-49704) for one-request pre-auth RCE.
vulnerability · blog.viettelcybersecurity.com
SharePoint Unknown CVE Unveiled: RCE via WebPart Properties Deserialization
CVE-2024-38018: SPSerializationBinder allowed binary deserialization of SafeControls classes via WebPart attached properties, enabling RCE with a crafted ysoserial payload.
vulnerability · blog.viettelcybersecurity.com
CVE-2022-22005 Microsoft Sharepoint RCE
Patch analysis of CVE-2022-22005, an RCE in Microsoft SharePoint (CVSS 8.8): diffing SharePoint 2016 builds pinpoints unsafe deserialization in ChartPreviewImage.loadChartImage().
vulnerability · blog.viettelcybersecurity.com
Phân tích lỗ hổng CVE-2022-22005 Microsoft Sharepoint RCE
A patch-diff analysis of CVE-2022-22005 (CVSS 8.8), a SharePoint RCE, tracing Microsoft's fix to a serialization binder restricting types during ChartPreviewImage.loadChartImage() deserialization.
vulnerability · blog.viettelcybersecurity.com
SharePoint CVE-2026-65660: From Anonymous Access to Pre-Auth RCE via EditingPageParser Type-Check Bypass
Breakdown of CVE-2026-65660, a SafeControls type-check bypass in SharePoint. It shows an in-memory webshell technique chaining into pre-auth RCE, affecting all versions through Subscription Edition.
Back