CVE-2026-45659 – High‑Severity Remote Code Execution in Microsoft SharePoint Server
Key Takeaways
- Severity: High (CVSS 8.8) remote code execution in Microsoft SharePoint Server.
- Impact: Authenticated Site Member can execute arbitrary code via deserialization of untrusted data.
- Active Exploitation: Added to CISA KEV with multiple exploit tools observed since early July 2026.
- Affected Versions: SharePoint Server 2016, 2019, and Subscription Edition (specific builds listed).
- Action: Deploy Microsoft’s out‑of‑band patch immediately and verify remediation.
Track live threat activity on the VulnSocial CVE page: https://vulnsocial.com/cve/CVE-2026-45659
Overview
CVE-2026-45659 is a remote code execution (RCE) flaw in Microsoft SharePoint Server. The vulnerability can be triggered by an authenticated attacker with the default “Site Member” role, requiring no additional privileges. Microsoft released an out‑of‑band security update in late May 2026. Within days, the vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Threat intelligence shows a sharp increase in reported exploit attempts and tool usage throughout early July 2026.
Technical Details
The flaw is a classic deserialization of untrusted data (CWE‑502) bug in SharePoint’s server‑side processing of serialized objects. An attacker can craft a malicious payload that, when processed by the SharePoint web service endpoint, results in arbitrary code execution on the server. Key attributes:
- Attack vector: Network‑accessible SharePoint web service (e.g., SOAP/REST endpoint) that accepts serialized objects.
- Privileges required: Site Member (low‑privilege) authentication.
- Complexity: Low – a single crafted request is sufficient.
- Impact: Full remote code execution with system‑level privileges on the SharePoint host.
The vulnerability’s CVSS vector aligns with “Network, Low complexity, Low privileges, No user interaction,” yielding a base score of 8.8 (High).
Severity & Impact
| Metric | Value |
|---|---|
| CVSS | 8.8 (High) |
| Vector | Network, Low complexity, Low privileges, No user interaction |
| CWE | CWE‑502 (Deserialization of Untrusted Data) |
| Exploitability | Active exploitation observed |
| KEV Status | CISA KEV |
Affected Products
The vulnerability affects the following SharePoint Server releases (representative list):
- SharePoint Server 2016 – build 16.0.5552.1002
- SharePoint Server 2019 – build 16.0.10417.20128
- SharePoint Server Subscription Edition – build 16.0.19725.20280
For the complete list of affected versions, see the CVE details page: https://vulnsocial.com/cve/CVE-2026-45659
Actionable Insights
- Patch Immediately: Apply Microsoft’s out‑of‑band patch for the affected builds. Use the Microsoft Update Guide to locate the correct security update.
- Validate Patch Deployment: Confirm the installed build numbers via SharePoint Central Administration or PowerShell (
Get-SPFarm). - Monitor Exploit Activity: Leverage the VulnSocial CVE page to watch for spikes in IDS/IPS alerts targeting SharePoint endpoints. Look for signatures of known exploit tools (identified on July 2‑3 2026).
- Restrict Access: Limit network exposure of SharePoint web services to trusted subnets and enforce least‑privilege for site members.
- Enable Detailed Logging: Turn on verbose logging for SharePoint web services and set up alerts for abnormal request patterns or deserialization errors.
- Integrate Threat Intel: Feed IOCs (e.g., malicious payload hashes, command‑and‑control URLs) from VulnSocial into your SIEM and endpoint detection platforms.
Remediation & Mitigation
- Download and Apply the Microsoft Security Update – obtain the appropriate patch from the Microsoft Update Guide.
- Verify Patch Installation – check the server build number matches the patched version.
- Enforce Least‑Privilege Access – review and tighten Site Member permissions; consider read‑only roles where feasible.
- Deploy WAF/IPS Rules – block suspicious serialized payloads targeting SharePoint service endpoints.
- Conduct Post‑Patch Testing – ensure SharePoint functionality remains intact after remediation.
- Update Incident Response Playbooks – add detection and containment steps for CVE-2026-45659 exploitation patterns.
Bottom Line
- CVE-2026-45659 is a high‑severity RCE flaw in Microsoft SharePoint Server with a CVSS score of 8.8.
- Active exploitation has been confirmed and the vulnerability is listed in the CISA KEV catalog.
- Immediate deployment of Microsoft’s out‑of‑band patch is essential.
- Ongoing monitoring, network segmentation, and strict permission hygiene are required to mitigate the risk.
References
- Microsoft Security Update Guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659
- Microsoft CVE JSON Advisory: https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-45659.json
- CISA Known Exploited Vulnerabilities Catalog: http://cisa.gov/known-exploited-vulnerabilities-catalog
- NVD Vulnerability Detail: https://nvd.nist.gov/vuln/detail/CVE-2026-45659
- GitHub Advisory (GHSA‑v4p8‑mg3p‑g94g): https://github.com/advisories/GHSA-v4p8-mg3p-g94g
- Belgian CERT Advisory: https://ccb.belgium.be/advisories/warning-microsoft-sharepoint-remote-code-execution-vulnerability-patch-immediately
#CVE #CVE202645659 #SharePoint #RCE #CISAKEV #Microsoft #HighSeverity