CISA Adds Actively Exploited SharePoint RCE CVE-2026-45659 to KEV Catalog

CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) catalog on July 1, 2026, after determining that the Microsoft SharePoint Server flaw is being exploited in the wild. The vulnerability is a remote code execution bug that Microsoft had already addressed in its May 2026 security updates. Inclusion in KEV is significant because CISA only adds entries when it has evidence of active exploitation, which changes the vulnerability's priority from a high-severity item that some organizations may have queued to one that demands immediate attention. Reporting from SecurityWeek and The Register corroborates the listing and the associated federal deadline.

According to the National Vulnerability Database and Microsoft's advisory, CVE-2026-45659 is a deserialization of untrusted data weakness (CWE-502) with a CVSS 3.1 base score of 8.8 (High) and the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. In plain terms, SharePoint can be tricked into rebuilding attacker-supplied serialized data into objects it then processes unsafely, leading to remote code execution. The vector confirms the practical risk profile: the attack is over the network, requires low complexity and no user interaction, but does require authentication. Microsoft states that an attacker needs only Site Member permissions, the standard contributor role, and no administrative or other elevated privileges to exploit it.

When Microsoft first published the advisory, it tagged the flaw with an "Exploitation Less Likely" assessment. CISA's decision to add it to KEV reflects later, real-world evidence and effectively supersedes that prediction. This is a recurring lesson in vulnerability management: an early exploitability forecast is not a guarantee, and defenders should re-prioritize when exploitation evidence appears. SharePoint is a high-value target because it sits at the center of document sharing and intranet workflows and is frequently reachable by remote staff, partners, and contractors, so a working remote code execution path is attractive to both ransomware crews and espionage actors.

The fix covers on-premises SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, all of which received the update in May 2026. Organizations that have not yet applied that update are exposed, and internet-facing SharePoint servers are the most pressing concern because they can be probed at scale. The exposure is greatest wherever contributor-level accounts are broadly granted, since only Site Member permissions are required. Federal Civilian Executive Branch agencies fall under CISA's binding directive and face the tightest timeline, but the underlying risk applies to any organization running the affected server versions.

CISA's KEV entry requires Federal Civilian Executive Branch agencies to remediate by July 4, 2026, an accelerated window consistent with Binding Operational Directive 26-04. Notably, CISA has not published technical details of the observed attacks, and, as SecurityWeek reported, there were no public reports of in-the-wild exploitation before the agency's listing. That means the specific exploitation method, the actors involved, and their objectives are not publicly known at this time. The absence of public detail does not lower the priority: a KEV listing is itself the signal that unpatched, exposed servers should be treated as at risk.

SharePoint Server has been a repeated focus for attackers, and CISA has previously listed other SharePoint flaws as exploited. Separately, in late June 2026 Microsoft's incident response team documented a case in which two unrelated attackers operated inside the same network, with one cluster attributed to Storm-2603, a group known for deploying Warlock ransomware by exploiting known on-premises SharePoint vulnerabilities. That investigation described initial access through a different flaw (a Gladinet Triofox vulnerability, CVE-2025-11371) rather than CVE-2026-45659. It is included here as context on the threat landscape around SharePoint; no public source has attributed the exploitation of CVE-2026-45659 specifically to Storm-2603 or any named actor.

The primary remediation is to apply Microsoft's May 2026 security update to every affected SharePoint server. Because the listing indicates active exploitation, patching alone may not be enough for internet-facing systems: teams should also review who holds Site Member or higher permissions, restrict or remove unnecessary external and guest contributor access, and limit internet exposure of SharePoint where feasible. On the detection side, inspect SharePoint servers for signs of compromise such as unexpected web shells, new files or scheduled tasks, newly created local or domain administrator accounts, and unusual child processes or deserialization errors in logs. Organizations that cannot patch immediately should increase monitoring and document the residual risk until the update is applied.

Two developments would raise the urgency further: the publication of a working proof-of-concept exploit, which typically expands opportunistic scanning, and any CISA or vendor update that names the actors or describes the exploitation technique. Because SharePoint incidents have historically involved multiple overlapping intrusions and living-off-the-land tooling, defenders who find one indicator should assume there may be more and investigate accordingly rather than treating a single alert as the full picture.

Unpatched on-premises SharePoint Server instances are exposed to authenticated remote code execution that is now confirmed under active exploitation, creating a path to server compromise, lateral movement, and potential ransomware deployment.

Security: High and low complexity to exploit for an authenticated user; active exploitation confirmed by CISA raises the likelihood of opportunistic attacks against exposed servers.

Privacy: Potential access to documents and data stored in or accessible through SharePoint if a server is compromised.

CISA added the actively exploited SharePoint Server RCE flaw CVE-2026-45659 (CVSS 8.8) to its KEV catalog on July 1, 2026, reversing Microsoft's earlier view that exploitation was unlikely and setting a July 4 federal remediation deadline.