CVE-2026-45484

Think of SharePoint as your company's shared filing cabinet and intranet. This flaw is like a faulty lock on an internal door — someone who already has a basic employee badge (a low-level login) can trick the system into giving them master-key access to everything, including files, settings, and other people's accounts.

This matters to you if your business runs its own SharePoint server — specifically SharePoint Server Subscription Edition, SharePoint Server 2019, or SharePoint Enterprise Server 2016 — rather than Microsoft's cloud-hosted SharePoint Online. It does not require an administrator account to exploit, only someone who already has any valid login to the SharePoint site, so internal users, contractors, or a compromised low-level account could trigger it.

This vulnerability is drawing rising attention from security researchers and threat trackers, and its characteristics make it an attractive target for attackers even though no confirmed active exploitation or public exploit code has been reported yet. Given the high potential impact (full takeover from a low-privileged login) and the trend toward increased attacker interest, you should treat this as urgent and patch without delay rather than waiting for confirmed attacks.

1. Inventory all on-premises SharePoint deployments and identify exact build numbers (Central Administration > System Settings, or PowerShell Get-SPFarm).
2. Prioritize internet-facing or widely-accessible SharePoint farms, since any authenticated user can trigger this (CWE-502 deserialization, PR:L, UI:N, network vector).
3. Apply vendor fixes: sharepoint server / Subscription Edition → 16.0.19725.20384; SharePoint Server 2019 → 16.0.10417.20153; SharePoint Enterprise Server 2016 → 16.0.5556.1005.
4. Follow Microsoft's update guide for prerequisite patches and known upgrade-path issues before applying cumulative updates: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45484.
5. As a temporary mitigation if patching is delayed, restrict SharePoint access to trusted internal networks/VPN only, enforce least-privilege on user accounts, and disable unnecessary features that process serialized data (e.g., custom workflows, InfoPath forms) where feasible.
6. Monitor SharePoint ULS logs and IIS logs for unusual deserialization errors, unexpected privilege changes, or new site collection administrators post-patch.
7. Not currently in CISA KEV and no public PoC exists, but EPSS scoring places this in the 98th percentile with a rising trend — reassess priority if exploitation is later confirmed.

CVSS 3.1 score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network-exploitable, low-complexity, low-privilege-required attack with high impact to confidentiality, integrity, and availability. Weakness is CWE-502 (Deserialization of Untrusted Data), allowing an authenticated low-privileged attacker to execute arbitrary logic server-side leading to full privilege escalation. Not listed in CISA KEV; no public exploit code identified. EPSS places likelihood of exploitation at 35.2% (98th percentile) with a rising trend, indicating elevated attacker interest despite no confirmed in-the-wild activity. Press/pulse attention is rising (roundup coverage, actor reference 'Nightmare Eclipse'), but this reflects media visibility, not confirmed exploitation.