🔴 CVE-2026-45659

CVE-2026-45659 is a critical deserialization of untrusted data (CWE-502) vulnerability in Microsoft SharePoint Server enabling authenticated remote code execution over the network with total technical impact. It is confirmed under active exploitation and listed in the CISA KEV catalog, making it a high-priority server-side threat where exploitation grants the attacker direct code execution on the SharePoint server.

← Back to Overview
HIGH_RISK
Risk Level
8.8
CVSS Score
NETWORK
Attack Vector
Initial Access
ATT&CK Tactic
T1190 — Exploit Public-Facing Application
ATT&CK Technique
HIGH
Deployment Risk
Yes (+75d)
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-05-22

Added to CISA KEV: 2026-07-01 40 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-45659 is a critical deserialization of untrusted data vulnerability residing within Microsoft Office SharePoint Server that enables an authorized, remote attacker to execute arbitrary code on the affected system. Because SharePoint often serves as a central repository for sensitive corporate data and internal communications, this flaw is highly significant, posing a severe risk to organizational infrastructure if exploited successfully.

Exploitation

  • Active Exploitation: The vulnerability is confirmed to be under active exploitation in the wild, leading to its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog as of July 1, 2026 [1][2].
  • Threat Actors: While specific advanced persistent threat (APT) groups or ransomware campaigns are often associated with KEV-listed vulnerabilities, security reports highlight it as a frequent target for exploitation following its public disclosure [2].
  • Proof-of-Concept/Exploits: Public awareness of the vulnerability is high, and security researchers have identified it as a critical RCE flaw with a CVSS score of 8.8, facilitating the development of weaponized exploit code [3][4].
  • Prerequisites: The attack is network-based and requires the attacker to be authenticated to the SharePoint environment [5][6]. No specific user interaction is required once the attacker has gained the necessary authentication credentials.

Affected Products & Patches

  • Affected Products: Multiple versions of Microsoft SharePoint Server are affected by this deserialization flaw [3].
  • Patch Availability: Microsoft released security updates to address this vulnerability in May 2026. Organizations were advised to apply these patches immediately, with U.S. federal agencies mandated to comply by July 4, 2026 [1][3].
  • Mitigations: The primary mitigation is the application of the official security updates provided by Microsoft. No other reliable workarounds exist to negate the vulnerability without patching.

Impact

  • System Access: Successful exploitation provides the attacker with the capability to execute arbitrary code on the underlying server with the privileges of the SharePoint service account.
  • Business Risk: For internet-facing SharePoint deployments, this vulnerability presents a critical business risk, as it can lead to full server compromise, unauthorized access to sensitive documents, lateral movement within the network, and potential data exfiltration or ransomware deployment [1].

Sources

  1. SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation

    CISA added CVE-2026-45659 SharePoint Server RCE to KEV following confirmed exploitation, requiring U.S. agencies to patch by July 4, 2026.

  2. CISA Adds One Known Exploited Vulnerability to Catalog

    CVE-2026-45659 Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability. This type of vulnerability is a frequent attack ...

  3. Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions

    The vulnerability, tracked as CVE-2026-45659, carries a CVSS score of 8.8. It has been assigned an important severity. "Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network," Microsoft said in an advisory released last week.

  4. Microsoft SharePoint Deserialization Vulnerabilities (CVE- ...

    Two deserialization vulnerabilities in Microsoft SharePoint Server, tracked as CVE-2026-47294 (CVSS 8.0) and CVE-2026-45659 (CVSS 8.8), allow ...

  5. CVE-2026-45659: SharePoint RCE Under Active ...

    CVE-2026-45659 is an authenticated remote code execution vulnerability affecting Microsoft SharePoint Server. According to Microsoft's advisory, ...

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed