Microsoft SharePoint CVE-2026-45659 (CVSS 8.8) RCE

Microsoft SharePoint Server is affected by CVE-2026-45659, a high-severity Remote Code Execution (RCE) vulnerability. This flaw, assigned a CVSS score of 8.8, is caused by the deserialization of untrusted data, enabling authenticated attackers to execute arbitrary code on vulnerable servers. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) catalog on July 1, 2026, confirming its active exploitation in the wild.

Initially addressed by Microsoft in May 2026, the vulnerability was first assessed with an "Exploitation Less Likely" status. However, its inclusion in the CISA KEV catalog shows a critical shift in its threat profile, indicating that threat actors have successfully weaponized this flaw. Organizations using SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016 must prioritize patching to mitigate immediate risks.

Active exploitation of CVE-2026-45659 shows the persistent targeting of enterprise collaboration platforms. A successful compromise could lead to significant operational disruption, data exfiltration, network penetration, or system compromise. Federal Civilian Executive Branch (FCEB) agencies were advised to apply the necessary fixes by July 4, 2026, which emphasizes the urgent need for remediation for all affected entities.

What is CVE-2026-45659 and why is it critical?

CVE-2026-45659 is a Remote Code Execution (RCE) vulnerability in Microsoft SharePoint Server rated high severity with a CVSS score of 8.8. This flaw permits an authenticated attacker to execute arbitrary code on the underlying SharePoint Server. The criticality of CVE-2026-45659 stems from active exploitation, confirmed by its inclusion in the CISA KEV catalog.

The vulnerability originates from the deserialization of untrusted data within the SharePoint framework. Deserialization vulnerabilities occur when an application reconstructs an object from data that can be manipulated by an attacker, which can lead to unexpected and malicious code execution. In the context of SharePoint, this means an attacker can craft a malicious data stream that, when processed by the server, forces it to execute commands under the privileges of the SharePoint application pool. This provides attackers with a powerful foothold for further compromise.

The primary risk associated with CVE-2026-45659 is the potential for complete server takeover. Once code execution is achieved, an attacker can install backdoors, exfiltrate sensitive data, disrupt services, or use the compromised server as a pivot point for lateral movement within the network. For organizations that rely on SharePoint for document management and collaboration, a successful RCE can severely impact business continuity, data confidentiality, and system integrity. The necessity for an authenticated attacker does not diminish its severity, as insider threats or compromised user accounts remain viable vectors for initial access.

Exploitation Chain and Attack Vector

The exploitation of CVE-2026-45659 is initiated via a network-based attack. The core vulnerability is a deserialization of untrusted data issue within Microsoft SharePoint Server. This class of vulnerability allows an attacker to inject malicious code during the process where a program converts data from a serialized format (e.g., a byte stream) to a usable object. If the application does not adequately validate or sanitize the incoming serialized data, specially crafted input can cause the application to execute arbitrary commands.

Preconditions for Exploitation:

A significant precondition for exploiting CVE-2026-45659 is that the attacker must be authenticated. Specifically, Microsoft states that an attacker with a minimum of Site Member permissions (PR:L) can use this flaw. This means that direct, unauthenticated exploitation from the internet is not possible. However, this still presents a substantial risk, as an attacker could gain the necessary authenticated access through various means, including phishing campaigns that compromise user credentials, brute-force attacks on weak credentials, or by exploiting other lower-severity vulnerabilities to obtain initial user-level access. Once authenticated, the attacker can send a crafted request to the SharePoint server that triggers the deserialization vulnerability, which leads to remote code execution.

In-the-Wild Exploitation Status:

CVE-2026-45659 was patched by Microsoft in May 2026. At the time of its patch release, Microsoft assessed the likelihood of exploitation as "Less Likely." However, on July 1, 2026, CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. This change indicates that threat actors have developed and deployed exploits for this vulnerability in real-world attacks. While the specific methods and identities of the threat actors actively exploiting CVE-2026-45659 are not publicly detailed, the presence of active exploitation signals an immediate and severe threat to unpatched SharePoint installations.

Historically, SharePoint has been a frequent target for threat actors, given its widespread use and the sensitive data it often manages. For instance, PurpleOps has previously covered our prior analysis of CVE-2025-53770 RCE, another actively exploited Remote Code Execution vulnerability in SharePoint. The ongoing trend of SharePoint RCEs shows the critical need for organizations to maintain up-to-date vulnerability management practices for these platforms.

While the specific post-exploitation activities for CVE-2026-45659 are not publicly detailed, threat actor methodologies observed in other compromises of SharePoint environments illustrate common objectives. These include establishing persistent access, escalating privileges, conducting lateral movement, and ultimately deploying payloads such as ransomware. Microsoft's separate findings about "Storm-2603," a threat actor known for deploying Warlock ransomware by exploiting known vulnerabilities in on-premises SharePoint servers since mid-2025, indicate the types of actors and campaigns that target SharePoint platforms. Although CVE-2026-45659 is not explicitly attributed to Storm-2603 in the provided research, the general field of SharePoint exploitation often involves sophisticated actors with clear financial or espionage motives.

No public Proof-of-Concept (PoC) code for CVE-2026-45659 has been publicly disclosed in the provided research, but active exploitation confirms functional exploits are in use by malicious actors.

Affected Products and Versions

The CVE-2026-45659 Remote Code Execution vulnerability affects multiple versions of Microsoft SharePoint Server. Organizations must identify all instances of these products within their infrastructure to ensure full remediation.

The affected product lines and versions are:

  • Microsoft SharePoint Server Subscription Edition: All versions prior to the May 2026 security updates.
  • Microsoft SharePoint Server 2019: All versions prior to the May 2026 security updates.
  • Microsoft SharePoint Enterprise Server 2016: All versions prior to the May 2026 security updates.

It is critical to note that the vulnerability impacts these server editions regardless of the specific service pack or cumulative update applied, provided they have not received the May 2026 patches. Organizations should consult official Microsoft documentation and their deployed version details to confirm susceptibility. Any unpatched instance within these product families is at risk of remote code execution if an authenticated attacker with Site Member permissions gains access.

Detection

Detecting CVE-2026-45659 exploitation or post-exploitation activity on SharePoint servers requires a multi-layered approach. This includes log analysis, network monitoring, and Endpoint Detection and Response (EDR) capabilities. Post-exploitation indicators are especially crucial given the RCE nature of the vulnerability.

Log Analysis:

  • SharePoint Unified Logging System (ULS) Logs: Monitor ULS logs for unusual activity patterns, specifically focusing on error messages related to deserialization failures or unexpected object instantiation. While direct exploitation might be obscured, subsequent errors or crashes could indicate an attempt.
  • Windows Event Logs:
  • Security Logs: Look for new user account creation (especially local or domain administrator accounts), privilege escalation attempts (Event IDs 4672, 4720), or changes to critical system configurations.
  • System Logs: Monitor for unexpected service restarts, crashes, or new scheduled tasks (Event IDs 4698, 4702) being added, as these can be used for persistence.
  • Application Logs: Pay attention to SharePoint-specific errors that fall outside normal operational parameters.
  • IIS Logs: Analyze Internet Information Services (IIS) logs for suspicious requests targeting SharePoint application pages. Look for abnormally large POST requests or unusual parameters that might indicate an attempt to send malicious serialized data.

Network Indicators:

  • Unexpected Outbound Connections: Monitor SharePoint servers for any outbound connections to unusual or unknown IP addresses, domains, or non-standard ports. This could indicate command-and-control (C2) communication, data exfiltration, or the downloading of additional malware.
  • High Bandwidth Usage: Sudden spikes in network egress from SharePoint servers, particularly during off-peak hours, could signal data exfiltration.
  • DNS Queries: Look for suspicious DNS queries originating from SharePoint servers that resolve to known malicious domains or infrastructure.
  • Protocol Anomalies: Identify non-standard protocol usage or encrypted traffic patterns from internal SharePoint servers to external destinations that are inconsistent with normal operations.

Endpoint Detection and Response (EDR) Queries:

  • Process Creation Anomalies: Query EDR telemetry for unusual child processes spawned by SharePoint-related processes (e.g., w3wp.exe, SharePoint Timer Service owstimer.exe). Look for executions of cmd.exe, PowerShell (powershell.exe), certutil.exe, bitsadmin.exe, or other administrative tools that are not part of routine SharePoint operations.
  • File System Modifications: Monitor for the creation or modification of executable files (.exe, .dll, .ps1), web shell files (.aspx, .jsp), or configuration files in unexpected directories on SharePoint servers.
  • Registry Modifications: Detect suspicious changes to Windows Registry keys, particularly those related to services, startup entries, or security configurations that could indicate persistence or defense evasion.
  • Security Software Tampering: Look for attempts to disable or modify security software, as threat actors often attempt to reduce visibility following initial compromise. For example, processes interacting with or terminating security agent services.
  • Lateral Movement Tools: If a SharePoint server is compromised, attackers may deploy tools like Velociraptor or establish remote access channels via Cloudflare tunneling, Zoho Assist, or Secure Shell (SSH) connections through Visual Studio Code. EDR systems should alert on the presence or execution of these tools if they are not authorized.

Organizations should also ensure that their threat intelligence feeds are updated with the latest Indicators of Compromise (IOCs) related to SharePoint exploitation and general deserialization vulnerabilities.

Remediation

Prompt and thorough remediation is essential to address the risks posed by CVE-2026-45659 and prevent further compromise. Given the active exploitation status, immediate action is warranted.

  • Apply Security Patches: The primary remediation for CVE-2026-45659 is to apply the security updates released by Microsoft in May 2026. These patches are available for:
  • SharePoint Server Subscription Edition
  • SharePoint Server 2019
  • SharePoint Enterprise Server 2016

Organizations should prioritize patching all affected SharePoint servers, starting with internet-facing instances and critical internal systems. Follow Microsoft's official guidance for patch deployment to ensure proper installation and avoid service disruption.

  • Implement Principle of Least Privilege: Review and enforce the principle of least privilege for all SharePoint user accounts. As exploitation requires a minimum of Site Member permissions, reducing unnecessary privileges across the platform can significantly limit the attack surface. Regularly audit user permissions and remove any excessive access rights.
  • Network Segmentation: Isolate SharePoint servers on a segmented network to limit the scope of potential attacks and lateral movement in the event of a successful compromise. Restrict network connectivity to only essential services and internal systems.
  • Outbound Traffic Filtering: Implement strict egress filtering on firewalls to prevent SharePoint servers from establishing outbound connections to unauthorized external IP addresses or domains. This can help mitigate command-and-control (C2) communications and data exfiltration attempts post-exploitation.
  • Credential Hygiene: Regularly rotate credentials for SharePoint service accounts and administrator accounts. Ensure strong, unique passwords are used and multi-factor authentication (MFA) is enforced wherever possible.
  • Enhanced Monitoring: After applying patches, increase vigilance in monitoring SharePoint server logs, network traffic, and endpoint telemetry for any signs of post-exploitation activity. This includes reviewing logs for new accounts, unusual processes, or suspicious network connections that might indicate a pre-existing compromise that occurred before patching.
  • Regular Vulnerability Scanning: Conduct routine vulnerability scans of SharePoint environments to identify any lingering vulnerabilities or misconfigurations.

Organizations should ensure that their incident response plans are prepared for potential compromise, including procedures for forensic analysis, system restoration, and communication.

Technical Takeaways

  • CVE-2026-45659 is a high-severity (CVSS 8.8) Remote Code Execution (RCE) vulnerability affecting Microsoft SharePoint Server, from the deserialization of untrusted data.
  • Active exploitation of this flaw has been confirmed, which led to its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog on July 1, 2026.
  • Successful exploitation requires an authenticated attacker with a minimum of Site Member permissions. This is a critical concern for organizations where user credentials could be compromised.
  • Affected SharePoint versions include SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, with patches released by Microsoft in May 2026.
  • The persistence of actively exploited vulnerabilities in widely used enterprise software like SharePoint shows the critical need for a proactive patching strategy and strong threat detection capabilities, especially considering emergency fixes for actively exploited SharePoint RCE zero-days are a recurring necessity.
  • Effective remediation requires immediate application of available security patches, coupled with enhanced monitoring, strict network segmentation, and enforcement of least privilege principles to mitigate both the vulnerability and potential post-exploitation activities.