CISA: SharePoint RCE Flaw CVE-2026-45659 Now Actively Exploited

CVE-2026-45659 is a deserialization-of-untrusted-data vulnerability in on-premises Microsoft SharePoint Server, classified under CWE-502, per Cyberpress's report. An authenticated attacker holding only Site Member permissions (PR:L) can send crafted serialized objects to a vulnerable SharePoint component and trigger remote code execution over the network (AV:N), Microsoft said in its advisory cited by BleepingComputer.

Microsoft rated the attack complexity as low, noting an attacker does not need detailed prior knowledge of the target system and can repeat the exploit reliably. No user interaction is required, which makes the flaw attractive for automated, large-scale scanning against internet-facing SharePoint farms.

Microsoft released the fix for CVE-2026-45659 on May 21 for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. The company acknowledged the CVE had been accidentally omitted from the May 2026 Security Updates, according to BleepingComputer.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on July 1, 2026, roughly six weeks after the fix shipped, and set a three-day remediation deadline of July 4 for federal civilian agencies under Binding Operational Directive 26-04. BOD 26-04 requires agencies to prioritize patching based on factors including KEV catalog inclusion, whether exploitation can be automated, and internet exposure, per CISA's own guidance cited in the source reporting.

The vulnerability affects all supported on-premises SharePoint Server versions: Subscription Edition, 2019, and 2016, according to CISA's alert. Shadowserver, an internet-scanning watchdog group, tracked over 10,000 SharePoint servers exposed online in early reporting, later refining that figure to over 8,500 exposed servers with more than 200 still unpatched against CVE-2026-45659, per BleepingComputer's follow-up coverage.

BOD 26-04, issued shortly before the KEV addition, requires Federal Civilian Executive Branch agencies to prioritize patching based on KEV inclusion, whether exploitation can be automated at scale, whether the asset is exposed to the internet, and whether successful exploitation grants attackers partial or full device control. CISA has stated stakeholders bear responsibility for assessing their own exposure and meeting the directive's timelines.

CISA has now confirmed CVE-2026-45659 is being used in ransomware attacks, not just isolated intrusion attempts, a shift that raises the operational stakes for any organization still running unpatched, internet-facing SharePoint Server instances. Since November 2021, CISA has flagged 14 actively exploited Microsoft SharePoint vulnerabilities, with eight also tied to ransomware campaigns, based on BleepingComputer's reporting.

• On-premises SharePoint farms remain a repeated ransomware entry point across multiple CVEs since 2021.
• CISA's SharePoint hardening alert, originally published July 14, 2026 and updated through August 2026, lists six related actively exploited SharePoint CVEs, showing attackers are chaining multiple bugs.
• Post-exploitation activity includes IIS machine-key theft, which can let attackers regain access even after a server is patched if keys are not rotated.

CISA's alert directs organizations to apply Microsoft's patches, verify successful installation, and shorten patch cycles going forward. It also recommends enabling Antimalware Scan Interface (AMSI) integration for every SharePoint web application in Full Mode where feasible, and watching for specific AMSI and Microsoft Defender Antivirus detections named in the alert, including Exploit:Script/ToolPaneAuthBypass.C for RCE coverage and Backdoor:MSIL/LeakFang.A!dha for post-exploitation activity involving IIS-protected secrets.

1. Apply Microsoft's SharePoint security updates and confirm successful installation.
2. Enable AMSI integration in Full Mode for each SharePoint web application.
3. Hunt for machine-key harvesters before rotating IIS machine keys to prevent re-theft.
4. Restrict SharePoint Central Administration access and place internet-facing farms behind a Layer 7 reverse proxy.

Microsoft has not updated its own CVE-2026-45659 advisory to formally tag it as exploited, even though CISA's KEV catalog and alert updates describe confirmed exploitation and ransomware abuse, according to BleepingComputer. That gap between vendor and government agency labeling is worth tracking, since it can affect how internal risk-scoring tools prioritize the patch.

CISA's related alert has been updated multiple times as new SharePoint CVEs were added to KEV, most recently CVE-2026-55040 on August 18, 2026, suggesting the on-premises SharePoint exploitation cluster is still active rather than closed. Administrators running any of the six listed CVEs should expect further updates and treat unpatched, internet-exposed SharePoint servers as a standing risk until confirmed otherwise.

Unpatched, internet-exposed on-premises SharePoint servers can be remotely compromised by any authenticated user with only Site Member permissions, and CISA has confirmed the flaw is now also used to deploy ransomware.

Security: CVE-2026-45659 is one of six actively exploited on-premises SharePoint CVEs CISA has added to its KEV catalog since April 2026, and one of 14 SharePoint flaws flagged as exploited since 2021, eight tied to ransomware.

Privacy: Data stored in compromised SharePoint document libraries and sites is exposed to unauthorized access once an attacker achieves code execution on the server.

CISA confirmed active exploitation and ransomware abuse of SharePoint flaw CVE-2026-45659, one of six related on-premises SharePoint CVEs added to its KEV catalog since April 2026.