CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalog on July 1, 2026, confirming that a high-severity remote code execution flaw in Microsoft SharePoint Server is being actively exploited in the wild. The vulnerability carries a CVSS score of 8.8 and allows any authenticated attacker with Site Member permissions to execute arbitrary code on the server over the network — no admin privileges required, and no user interaction needed. For any organization running on-premises SharePoint, this alert demands immediate attention.
The root cause is a deserialization-of-untrusted-data flaw in Microsoft Office SharePoint Server. Deserialization vulnerabilities are among the most reliable classes of remote code execution because they let an attacker feed crafted objects into application logic that reconstructs those objects as executable code. In this case, an authenticated low-privilege user can send a specially crafted request that the SharePoint server deserializes into executable payloads. Microsoft patched CVE-2026-45659 in its May 2026 security updates for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, but the patch only works if administrators have actually applied it.
What makes this alert particularly significant is the gap between Microsoft’s own assessment and reality on the ground. Microsoft originally rated the exploitation likelihood as „Less Likely,” but CISA’s decision to add the flaw to the KEV catalog — reserved for vulnerabilities with confirmed evidence of active exploitation — means attackers are already using it. The agency set a remediation deadline of July 4, 2026 for Federal Civilian Executive Branch agencies, a remarkably tight three-day window that underscores the urgency. Private-sector organizations should treat this with equal seriousness, since SharePoint Servers are widely deployed in enterprise environments and often sit at the intersection of document management, authentication, and internal communication.
The exploitation context adds another layer of concern. Microsoft’s Incident Response team recently disclosed that the threat actor tracked as Storm-2603 has been exploiting known on-premises SharePoint vulnerabilities since mid-2025, deploying Warlock ransomware through lateral movement and privilege escalation. While Storm-2603’s earlier campaigns leveraged a different initial access vector (CVE-2025-11371 in Gladinet Triofox), the group’s sustained focus on SharePoint as an attack surface makes any new RCE in that ecosystem a natural target. In the same investigation, Microsoft uncovered a second, unrelated threat actor operating simultaneously within the victim environment, using DLL side-loading and custom backdoors — a reminder that one exploitation pathway often attracts multiple adversaries.
What the vulnerability does
CVE-2026-45659 enables a network-based attack where an authenticated attacker with the lowest standard SharePoint role (Site Member, or PR:L in privilege notation) can achieve remote code execution on the server. The attacker does not need administrative rights, does not need to trick an administrator into any action, and does not need physical access. The deserialization chain converts untrusted input directly into server-side code execution. Once the attacker has code execution on the SharePoint server, they can pivot to domain resources, exfiltrate document libraries containing sensitive business data, deploy persistence mechanisms, or install ransomware — exactly the progression seen in Storm-2603 campaigns.
Who is affected and how to respond
Any organization running an unpatched on-premises SharePoint Server — Subscription Edition, 2019, or Enterprise Server 2016 — is potentially exposed. SharePoint Online (Microsoft 365) is not affected by this specific vulnerability because Microsoft manages the cloud infrastructure and has applied the patch automatically.
Organizations should take the following steps. First, determine whether SharePoint Server is present in the environment and whether the May 2026 security update (KB5002863 for Subscription Edition, corresponding KBs for 2019 and 2016) has been applied. If the patch is missing, apply it immediately, and do not wait for a regular patching cycle. Second, audit SharePoint authentication and role assignments: the exploit requires an authenticated Site Member, so reducing unnecessary memberships and enforcing multi-factor authentication on SharePoint access shrinks the attack surface. Third, review logs for indicators of compromise — unusual deserialization errors, unexpected process execution from SharePoint application pools, newly created local or domain administrator accounts, and outbound connections to Cloudflare tunnels or remote-access tools like Zoho Assist. Microsoft’s detailed guidance on Storm-2603 indicators of compromise is available on the Microsoft Security Blog. Finally, if SharePoint servers cannot be patched immediately, consider isolating them from direct internet access and restricting authentication to trusted networks as a temporary containment measure.
How to Check Your Infrastructure for This Vulnerability
Even if your organization does not run SharePoint Server directly, the attack surface from this CVE extends to any connected service that processes documents or workflows from SharePoint. Here is a practical approach to assess exposure:
- Inventory SharePoint deployments. Use your asset management tool or a network scanner to identify all SharePoint Server instances, including test and staging environments that may not receive patches on schedule.
- Check patch level against Microsoft’s advisory. Compare the installed version with the fixed version listed in the official Microsoft Security Update Guide. If you cannot patch immediately, verify that the recommended mitigations are in place.
- Review perimeter and network logs. Look for the indicators of compromise (IoCs) published by Microsoft and CISA. Pay special attention to unusual POST requests to SharePoint endpoints, unexpected authentication attempts, and large data transfers from SharePoint servers.
- Validate that defense-in-depth controls are active. Web Application Firewalls (WAFs), network segmentation, and endpoint detection should all be confirmed as running and updated with the latest threat signatures.
- Confirm backup integrity. If exploitation occurred before detection, verified backups are the fastest path to recovery. Test restore procedures now rather than during an incident.
Immediate Response Checklist for SharePoint RCE (CVE-2026-45659)
Use this checklist to confirm that your team has addressed each critical response action:
- ☑ All SharePoint Server instances identified and version-confirmed
- ☑ Microsoft security patch applied or scheduled within 48 hours
- ☑ Temporary mitigations (network segmentation, WAF rules) in place if patching is delayed
- ☑ Perimeter and SharePoint logs reviewed for IoCs from the past 30 days
- ☑ Affected systems isolated if exploitation is confirmed
- ☑ Incident response team notified and escalation path documented
- ☑ Backups verified and restoration tested
- ☑ Stakeholder and leadership communication prepared
- ☑ Post-incident review scheduled once containment is achieved
This checklist is also relevant for any similar actively exploited RCE vulnerability in enterprise collaboration platforms. The pattern of patch → verify → monitor → review applies universally.
Related resources from CodeRiskTools: If your organization uses automated code review and security scanning in CI/CD pipelines, our CI Gates for AI-Generated Code guide and Secret Scanning for AI-Generated Code kit can help catch similar infrastructure risks before they reach production.
Sources and evidence
- CISA Known Exploited Vulnerabilities Catalog entry for CVE-2026-45659, added July 1, 2026, with a remediation due date of July 4, 2026. cisa.gov/known-exploited-vulnerabilities-catalog
- Microsoft Security Response Center advisory and May 2026 security update for SharePoint Server
- NVD entry for CVE-2026-45659 — CVSS 8.8, deserialization of untrusted data
- Microsoft Security Blog: Disrupting active exploitation of on-premises SharePoint vulnerabilities — Storm-2603 and Warlock ransomware details
- The Hacker News, SOCRadar, and CybelAngel threat analysis reporting on CISA KEV addition and exploitation context
This alert covers a confirmed, actively exploited vulnerability with official CISA and Microsoft documentation. The technical details are drawn from public advisories; no proprietary or victim-specific evidence is included. Organizations should consult their own security teams and Microsoft’s official guidance for environment-specific remediation.
