SharePoint RCE CVE-2026-45659: CISA KEV Alert After Active Exploitation

CISA has confirmed active exploitation of a high-severity Microsoft SharePoint remote code execution vulnerability tracked as CVE-2026-45659 (CVSS: 8.8). Organizations running supported SharePoint Server versions should patch immediately to prevent unauthorized code execution over the network.

This SharePoint RCE flaw does not require administrator privileges to exploit. Furthermore, any authenticated attacker with Site Member permissions can trigger deserialization of untrusted data to run code remotely on the server. Federal agencies must apply patches by July 4, 2026 under Binding Operational Directive 26-04.

What Happened: Microsoft SharePoint CVE-2026-45659 Added to CISA KEV

On July 1, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. Microsoft had originally patched the vulnerability during the May 2026 Patch Tuesday cycle, releasing security updates for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.

According to Microsoft’s advisory, the flaw stems from deserialization of untrusted data within Microsoft Office SharePoint. In a network-based attack, an authenticated user with Site Member permissions could execute code remotely on the SharePoint Server. Consequently, the vulnerability presents a clear path for attackers to move laterally within enterprise environments that rely on SharePoint for collaboration and document management.

Microsoft initially rated the issue with an “Exploitation Less Likely” assessment. However, CISA’s KEV addition confirms that threat actors have found ways to weaponize the flaw in real-world attacks. The identity of the threat actors and the scope of exploitation remain unclear at this time.

Technical Details of the SharePoint Deserialization Vulnerability

CVE-2026-45659 is a deserialization of untrusted data vulnerability in Microsoft SharePoint Server. The core issue occurs when SharePoint processes serialized data from an untrusted source without proper validation. Moreover, because SharePoint operates as a central document repository and collaboration hub in many organizations, successful exploitation can provide attackers with a foothold inside corporate networks.

• Attack vector: Network-based — an authenticated attacker sends a crafted request over the network
• Privileges required: Site Member permissions (not administrator or elevated privileges)
• Impact: Remote code execution on the SharePoint Server
• Affected versions: SharePoint Server Subscription Edition, SharePoint Server 2019, SharePoint Enterprise Server 2016
• Patch availability: Released May 12, 2026 via Microsoft security updates

While Microsoft described exploitation as less likely in its advisory, the confirmed active exploitation demonstrates that determined threat actors can still chain this vulnerability with other access techniques to achieve full server compromise.

Business and Operational Impact

SharePoint Server is widely deployed in government agencies, healthcare organizations, financial institutions, and large enterprises. Therefore, the confirmed active exploitation of CVE-2026-45659 carries significant business and operational risks:

• Data exposure: Compromised SharePoint servers may expose sensitive documents, proprietary data, and intellectual property
• Lateral movement: Attackers can pivot from the SharePoint server to other systems within the Active Directory domain
• Service disruption: RCE exploitation could lead to downtime for collaboration platforms critical to business operations
• Compliance implications: Organizations subject to HIPAA, GDPR, or CMMC requirements may face regulatory consequences after a confirmed breach
• Supply chain risk: Third-party vendors and partners with SharePoint access could inadvertently introduce threats into connected environments

CISA’s KEV listing and Binding Operational Directive 26-04 make this vulnerability a priority for federal agencies. In addition, private sector organizations should treat the flaw with similar urgency given the confirmed exploitation.

Mitigation and Recommendations

Organizations running affected SharePoint Server versions should apply the available Microsoft security updates as soon as possible. However, patching alone may not be sufficient if an attacker has already established persistence.

Immediate Actions for Defenders

1. Apply Microsoft patches immediately. Install the May 2026 security updates for your specific SharePoint Server version from the Microsoft Update Catalog
2. Audit SharePoint permissions. Review Site Member and Site Owner assignments to identify over-privileged accounts
3. Monitor deserialization activity. Look for unusual SharePoint web requests and process execution patterns in security logs
4. Scan for indicators of compromise. Check SharePoint and IIS logs for signs of post-exploitation activity predating patch installation
5. Enable network segmentation. Restrict SharePoint Server network access to only required endpoints and user segments

Additional Guidance

Organizations that cannot patch immediately should consider temporarily disabling unnecessary SharePoint web parts and external-facing SharePoint services until updates can be applied. Moreover, implementing Web Application Firewall (WAF) rules to detect suspicious deserialization payloads may provide partial protection.

Bottom line: CVE-2026-45659 is actively exploited and requires immediate patching for all affected SharePoint Server versions. Reduce user privileges, monitor for suspicious activity, and verify your organization is not already compromised.

Incident Summary

CVE ID / Incident:	CVE-2026-45659
Affected Systems:	Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, SharePoint Enterprise Server 2016
Disclosure Date:	May 12, 2026 (patched); July 1, 2026 (CISA KEV addition)
Patch Status:	Available — patches released May 12, 2026

References

1. CISA, “CISA Adds One Known Exploited Vulnerability to Catalog,” July 1, 2026, https://www.cisa.gov/news-events/alerts/2026/07/01/cisa-adds-one-known-exploited-vulnerability-catalog, accessed July 2, 2026.
2. Microsoft Security Response Center, “CVE-2026-45659,” May 12, 2026, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659, accessed July 2, 2026.
3. The Hacker News, “SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation,” July 2, 2026, https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html, accessed July 2, 2026.