CVE-2026-45454Patch(microsoft / sharepoint_server)

HIGHCVSS 8.8 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch microsoft sharepoint_server systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts

Recommended action window: Immediate (within 24h)

NVD description

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

microsoft CVEs Back to dashboard

6.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45454

Weakness type (CWE)

CWE-22

Priority

HIGH

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

sharepoint_server

Threat summary

Active exploitation appears in 1 classified signals
Exploit tooling references are present in monitored signal
Patch or workaround signal is available
5 mentions across 5 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
General: 1 classified signal
Peaked 4d ago at 1 mentions (2026-06-10); latest day: 1
5 total mentions across 5 days

Affected systems

Vendors

microsoft

Products

sharepoint_server

2 versions affected across 1 product

Deep dive

Activity timeline5 mentions / 5d

Signal classification5 categories

Patch

120.0%

General

120.0%

Exploit

120.0%

Active Exploitation

120.0%

Disclosure

120.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-10	1	Patch1
2026-06-11	1	General1
2026-06-13	1	Exploit1
2026-06-17	1	Active Exploitation1
2026-08-08	1	Disclosure1

Full discourse5 posts

Aretiq.AI@AretiqAI135d
Exploit
SharePoint Server RCE via webshell upload — CVE-2026-45454. A user with basic Contribute perms can upload an ASPX webshell to the Master Page Gallery and get code execution as the app pool identity. One HTTP request, no admin needed. Patch now. https://aretiq.ai/research/12/
Post summary
The post details a SharePoint Server RCE that can be achieved with a single HTTP request by uploading an ASPX webshell using basic permissions, and urges users to apply the available patch.
046115711617.9K
213 followersView on X
Swissky@pentest_swissky79d
Disclosure
CVE-2026-45454 — Microsoft SharePoint Server Upload Page Folder Path Traversal to Remote Code Execution - @AretiqAI https://aretiq.ai/research/vul260531-cve-2026-45454-microsoft-sharepoint-server-upload-page-folder-path-traversal/
Post summary
AretiqAI announces a new Microsoft SharePoint Server vulnerability (CVE‑2026‑45454) that allows path‑traversal‑based RCE, with more details available on their research page.
13501397612.9K
23.1K followersView on X
Autumn Good@autumn_good_35137d
General
MSは低く評価してますが、ここで書かれている構成の場合はかなり危険ですね...（近々悪用されるでしょうね CVE-2026-45454 — Microsoft SharePoint Server Upload Page Folder Path Traversal to Remote Code Execution https://aretiq.ai/research/vul260531-cve-2026-45454-microsoft-sharepoint-server-upload-page-folder-path-traversal/
Post summary
The entry notes a Microsoft SharePoint Server vulnerability with a remote code execution path, remarks on its risk, but offers no PoC, exploit details, or patch information.
02034520
7.0K followersView on X
Aretiq.AI@AretiqAI138d
Patch
CVE-2026-45454 — SharePoint Server path traversal to RCE. Authenticated users can upload files to restricted document libraries via Upload.aspx List/RootFolder mismatch, including webshells to the Master Page Gallery. Patch: KB5002874/KB5002880. https://aretiq.ai/research/12/
Post summary
CVE‑2026‑45454 is a SharePoint Server path traversal flaw that lets authenticated users upload and execute webshells, and Microsoft has released patches KB5002874 and KB5002880 to address the vulnerability.
00032215
144 followersView on X
VulDB 🛡@vuldb132d
Active Exploitation
It is possible to see elevated activities targeting Microsoft SharePoint (CVE-2026-45454) https://vuldb.com/vuln/369662/cti
Post summary
The post reports increased activity targeting CVE-2026-45454 on Microsoft SharePoint, indicating potential exploitation but providing no technical details or patch guidance.
0000085
2.2K followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	microsoft	sharepoint_server	-	-	-
App	microsoft	sharepoint_server	2016	-	-
App	microsoft	sharepoint_server	2019	-	-

Explore more

Back to dashboard microsoft CVEs sharepoint_server vulnerabilities

What researchers are saying

CVE-2026-45454

Aretiq.AI[verified]@AretiqAIExploit

The post details a SharePoint Server RCE that can be achieved with a single HTTP request by uploading an ASPX webshell using basic permissions, and urges users to apply the available patch.

Swissky[verified]@pentest_swisskyDisclosure

AretiqAI announces a new Microsoft SharePoint Server vulnerability (CVE‑2026‑45454) that allows path‑traversal‑based RCE, with more details available on their research page.

Autumn Good@autumn_good_35General

The entry notes a Microsoft SharePoint Server vulnerability with a remote code execution path, remarks on its risk, but offers no PoC, exploit details, or patch information.

Aretiq.AI@AretiqAIPatch

CVE‑2026‑45454 is a SharePoint Server path traversal flaw that lets authenticated users upload and execute webshells, and Microsoft has released patches KB5002874 and KB5002880 to address the vulnerability.

VulDB 🛡@vuldbActive Exploitation

The post reports increased activity targeting CVE-2026-45454 on Microsoft SharePoint, indicating potential exploitation but providing no technical details or patch guidance.