Cloud Security

CVE-2026-45659: SharePoint RCE Exploited, CISA Sets Deadline

Q: What CVE-2026-45659 Actually Does?

The vulnerability is a textbook deserialization of untrusted data weakness (CWE-502) in SharePoint Server. Microsoft rates it CVSS 8.8, and the exploitation profile is unusually forgiving for the attacker: the vector is network-reachable, complexity is low, no user interaction is needed, and privileges required are minimal. Crucially, you do not need admin rights. Microsoft's advisory states that "an authenticated attacker, who has a minimum of Site Member permissions (PR:L), could execute code remotely on the SharePoint Server." Any low-trust account that can reach the site — a contractor, a phished employee, a service principal with overbroad tenant access — is enough to detonate the payload. That collapses the usual assumption that RCE requires some form of privileged foothold first. The flaw affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition . SharePoint Online (Microsoft 365) is not in scope, but the long tail of self-hosted and sovereign-cloud SharePoint estates very much is.

Q: Why Low-Priv Abuse Changes Everything?

The detail that should reframe your risk picture is PR:L . Most SharePoint hardening guidance still implicitly assumes RCE requires an admin or a privileged service account. CVE-2026-45659 disproves that for an entire class of deserialization bugs: any Site Member will do. That makes identity hygiene — least privilege on site collections, aggressive review of dormant and external member accounts, conditional access in front of on-prem farms — a primary control, not a secondary one. It also means your blast-radius assumption is wrong. One phished user with read-style site access is no longer a containment problem; it is a code-execution problem on the server itself. The path from "stolen low-priv session" to "server shell" is now a single unauthenticated-style step away.

July 3, 2026 · 7 min read · By CloudAI Security

CISA added CVE-2026-45659, a high-severity remote code execution flaw in Microsoft SharePoint Server, to its Known Exploited Vulnerabilities catalog on July 1, 2026, after confirming active attacks. The deserialization bug lets any authenticated user with low Site Member rights run code on unpatched on-prem servers, and Microsoft shipped a fix back on May 21 — but the patch was initially omitted from the May 2026 Security Updates, leaving roughly six weeks of silent exposure before the federal patch deadline of July 4.

CISA Confirms SharePoint RCE Under Attack

The KEV addition converts a slow-moving patch into a 72-hour federal mandate. Microsoft rates CVE-2026-45659 at CVSS 8.8 and had tagged it “Exploitation Less Likely” — a label that almost certainly kept it off triage lists until CISA’s evidence of in-the-wild exploitation forced the issue. Attackers are already inside vulnerable estates, and the long tail of self-hosted SharePoint servers is the target.

What CVE-2026-45659 Actually Does

The vulnerability is a textbook deserialization of untrusted data weakness (CWE-502) in SharePoint Server. Microsoft rates it CVSS 8.8, and the exploitation profile is unusually forgiving for the attacker: the vector is network-reachable, complexity is low, no user interaction is needed, and privileges required are minimal.

Crucially, you do not need admin rights. Microsoft’s advisory states that “an authenticated attacker, who has a minimum of Site Member permissions (PR:L), could execute code remotely on the SharePoint Server.” Any low-trust account that can reach the site — a contractor, a phished employee, a service principal with overbroad tenant access — is enough to detonate the payload. That collapses the usual assumption that RCE requires some form of privileged foothold first.

The flaw affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. SharePoint Online (Microsoft 365) is not in scope, but the long tail of self-hosted and sovereign-cloud SharePoint estates very much is.

A 44-Day Window Nobody Flagged

Microsoft released the patch on May 21, 2026, yet the CVE was accidentally omitted from the May 2026 Security Updates announcement, meaning many patch teams never saw it in their normal Patch Tuesday cadence (BleepingComputer). CISA did not list it until July 1 — a gap of roughly six weeks during which defenders had a fix in hand but little reason to prioritize it.

That sequencing failure is the real story. Microsoft’s own exploitability assessment tagged the bug “Exploitation Less Likely,” a label that almost certainly kept it off triage lists. CISA’s KEV entry now overrides that with a hard federal deadline of July 4, 2026 under Binding Operational Directive 26-04 (CISA KEV). In other words: the patch existed for 44 days, and it took in-the-wild exploitation to force urgency.

SharePoint Is Now Ransomware’s Front Door

This is not a one-off. CISA has catalogued 11 Microsoft SharePoint vulnerabilities abused in the wild since 2021, and seven of those have been tied to ransomware operations (BleepingComputer). The platform has quietly become one of the most reliable initial-access vectors in enterprise environments, because it sits on trusted networks, holds credentials and configuration files, and is rarely decommissioned.

The threat-actor context confirms the pattern. Microsoft’s Incident Response team recently detailed Storm-2603, a group that has been exploiting on-premises SharePoint flaws since mid-2025 to deploy Warlock ransomware. In one investigation, Microsoft found two unrelated threat actors operating simultaneously inside the same network — Storm-2603 establishing multiple persistence channels, and a second cluster using DLL side-loading and custom backdoors to muddy attribution (The Hacker News). The April 2026 Patch Tuesday also closed a separate SharePoint zero-day, underscoring that the surface is under sustained pressure.

10,000 Servers Still Facing the Internet

Exposure data makes the patch arithmetic stark. Shadowserver is currently tracking over 10,000 SharePoint servers exposed to the public internet, with no public breakdown of how many have applied the May 21 fix (BleepingComputer). Each internet-facing instance is a candidate target for an authenticated attacker using harvested or low-priv creds, and a single compromised server becomes a staging point for lateral movement.

The question for cloud and hybrid teams is not “are we patched” but “do we even have an accurate inventory of self-hosted SharePoint instances?” Sovereign, air-gapped, and legacy SharePoint deployments routinely escape cloud-native asset management and CSPM coverage. If your exposure model assumes everything important lives in Microsoft 365, this CVE is your correction.

Detection and Triage: What to Hunt

Patching is necessary but not sufficient. Storm-2603 and similar groups layer their post-exploitation to evade EDR, so incident response should assume a successful detonation has already begun persistence work. Microsoft’s findings point to several concrete IOCs and behaviors worth tuning detection rules against:

Legitimate-tool abuse: deployment of Velociraptor and remote-access channels through Cloudflare Tunneling, Zoho Assist, and SSH over Visual Studio Code — each designed to blend with trusted admin activity (The Hacker News).
Local file inclusion probing: requests for win.ini and web.config against SharePoint, often indicating chained entry through a separate flaw such as CVE-2025-11371 in Gladinet Triofox (CVSS 9.1).
Privilege escalation: creation of new local and domain administrator accounts — a high-signal event that should alert immediately.
EDR tampering: the vulnerable driver NSecKrnl.sys used to weaken endpoint visibility, a classic bring-your-own-vulnerable-driver move.

Hunt for outbound tunnel connections from SharePoint hosts, new admin principals created in a short window, and any SharePoint process spawning child shells or VS Code remote sessions. If you see all three together, treat it as confirmed compromise rather than anomaly.

Why Low-Priv Abuse Changes Everything

The detail that should reframe your risk picture is PR:L. Most SharePoint hardening guidance still implicitly assumes RCE requires an admin or a privileged service account. CVE-2026-45659 disproves that for an entire class of deserialization bugs: any Site Member will do. That makes identity hygiene — least privilege on site collections, aggressive review of dormant and external member accounts, conditional access in front of on-prem farms — a primary control, not a secondary one.

It also means your blast-radius assumption is wrong. One phished user with read-style site access is no longer a containment problem; it is a code-execution problem on the server itself. The path from “stolen low-priv session” to “server shell” is now a single unauthenticated-style step away.

The 72-Hour Patching Playbook

CISA’s July 4 deadline is federal, but every organization running on-prem SharePoint should treat it as a hard target. Prioritize by version and exposure, and verify the fix actually applied — the May-omission error means some patching tools may still not reference CVE-2026-45659 cleanly.

Affected Version	Action	Priority
SharePoint Server Subscription Edition	Apply May 21, 2026 update; confirm build	Critical — if internet-facing
SharePoint Server 2019	Apply May 21, 2026 update	High
SharePoint Enterprise Server 2016	Apply May 21, 2026 update	High (EOL risk)
SharePoint Online (M365)	No action — not affected	None

For instances you cannot patch within the window, CISA’s directive is explicit: “follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.” Practically, that means restricting network exposure, segmenting SharePoint away from identity stores, and forcing re-authentication on site access until the update lands. Accepting the risk quietly is no longer a defensible position once exploitation is confirmed.

The same week’s Microsoft trouble runs deeper than SharePoint — six Defender zero-days with one still unpatched shows the Microsoft estate under coordinated pressure.
Identity-layer patching matters as much as the app layer: see the Netlogon CVE-2026-41089 domain-controller guidance for the same low-priv-to-full-takeover pattern.
Authenticated RCE as a data-theft springboard also drove the ShinyHunters PeopleSoft zero-day campaign — a useful parallel on enterprise-app exposure.