---
id: 7288
title: "CVE-2026-33112: SharePoint XmlValidator Bypass Enables Low-Privilege RCE"
cve: CVE-2026-33112
source_domain: blog.viettelcybersecurity.com
source_url: "https://blog.viettelcybersecurity.com/cve-2026-33112/"
published_at: "2026-06-23T11:21:31Z"
tags: ["rce", "deserialization", "sharepoint", "xml", "cve-2026-33112", "performancepoint"]
phying_url: "https://phying.com/item/7288"
lang: en
---

# CVE-2026-33112: SharePoint XmlValidator Bypass Enables Low-Privilege RCE

## Summary

CVE-2026-33112: a network-imported XSD schema bypasses SharePoint's XmlValidator, and the PerformancePoint PPSAuthoringService revives ExcelDataSet deserialization for low-privilege RCE.

## Intelligence Metadata

- **Sources:** blog.viettelcybersecurity.com
- **CVE:** CVE-2026-33112
- **Published:** 2026-06-23T11:21:31Z
- **Original:** https://blog.viettelcybersecurity.com/cve-2026-33112/
- **Phying News:** https://phying.com/item/7288