The CVSS 8.8 score on CVE-2026-65665 is drawing attention, but the more important analytical move is questioning what 'authorized attacker' actually means in a SharePoint context — and whether the CVSS model captures the real risk.
The vulnerability is in SharePoint's deserialization handling, and Microsoft has classified it as requiring some level of authorized access to exploit. That's the critical ambiguity: does 'authorized' mean farm administrator, site collection owner, or a site collaborator who can upload a custom workflow? The CVSS treats authorization as a binary threshold, but SharePoint permissions are a spectrum, and that spectrum determines whether you're looking at lateral movement within an already-privileged position or a genuine privilege escalation. The historical pattern — visible across CVE-2019-0604 and related flaws — is that these deserialization bugs cluster in backward-compatibility layers and service-to-service communication paths where SharePoint's serialization surface has accumulated the most technical debt. That clustering isn't coincidental; it's where old object formats have been bolted onto new code for cross-version compatibility.
The EPSS score of 0.01733 is telling. A high-severity deserialization flaw in a widely-deployed platform with only ~1.7% exploitation probability in 30 days suggests either complex preconditions for weaponization or limited public exploit development so far. That should temper the urgency calculus — patch it, but the exploitation complexity may be higher than the CVSS implies.
What many analysts are missing is the blast radius once exploitation succeeds. SharePoint is the integration hub for most enterprise Microsoft deployments. Code execution on SharePoint, regardless of the permission tier required to trigger it, provides pivot points into Entra ID tokens, Power Automate workflows, Teams conversations, and line-of-business systems that implicitly trust SharePoint's object model. The authorization requirement gates entry; it doesn't contain the explosion radius.
There's also a temporal decay problem that the CVSS model doesn't capture. Authorized access in SharePoint isn't static — contractor accounts get deprovisioned from AD but retain site collection admin rights, business users who created custom workflows in 2019 still appear as owners on subsites they haven't touched since. The 'authorized attacker' at disclosure may be a fundamentally different threat actor six months later: a deprovisioned contractor's stale site collection admin rights, a forgotten service account that should have been rotated, or an abandoned InfoPath form still executing deserialization code written by someone who left the organization.
For compensating controls beyond patching: identify and disable unused InfoPath form services, audit DataView Web Parts referencing custom assemblies, and flag site collections where the primary admin hasn't logged in over 90 days. These orphaned code paths represent the longest exposure windows — code deployed when the developer understood the risks, then left behind. That's where the 'authorized attacker' likely lives in practice: not as a malicious insider, but as a permission that should have been revoked and wasn't.