CVE-2026-45659

This is a security hole in Microsoft SharePoint Server where a bad actor can cause SharePoint to run attacker-chosen code. A common real-world path is that the attacker already has a low-level SharePoint account, such as a Site Member, and uses it to get control. If successful, they can potentially take over the server and access or alter your business files stored in SharePoint.

This matters if you run any of these products: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server Subscription Edition, Microsoft SharePoint Server, or Microsoft SharePoint Server 2019. Because exploitation involves an authenticated attacker with minimal permissions (Site Member), you should focus on whether someone could realistically reach SharePoint with a low-privilege account. CISA also directs owners to evaluate each asset’s internet exposure; the risk is higher when SharePoint is reachable from the internet and attackers can obtain or already have SharePoint access.

This is RED because CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) catalog with evidence of active exploitation, meaning attackers are already using it in the real world. Patch quickly to the fixed SharePoint builds listed by Microsoft, and treat the CISA remediation deadline as the minimum standard.

1. Confirm scope (what you run)

   • Identify every Microsoft SharePoint deployment in your environment, limited to: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server Subscription Edition, Microsoft SharePoint Server, and Microsoft SharePoint Server 2019.
   • For each one, record the current SharePoint build number.

2. Determine whether you are exposed (build check)

   • Consider yourself exposed if your build is below the fixed versions below for the specific product:
     • Microsoft SharePoint Server: fixed in 16.0.19725.20280
     • Microsoft SharePoint Enterprise Server 2016: fixed in 16.0.5552.1002
     • Microsoft SharePoint Server 2019: fixed in 16.0.10417.20128
     • Microsoft SharePoint Server Subscription Edition: fixed in 16.0.19725.20280

3. Patch (the permanent fix)

   • Upgrade each affected SharePoint Server instance to the matching fixed build.
   • Use Microsoft’s update guidance for CVE-2026-45659 (see Microsoft Update Guide for the exact steps for your environment).

4. If you can’t patch immediately (temporary risk reduction)

   • Follow CISA KEV instructions: apply mitigations in line with the vendor instructions, and if mitigations cannot be applied, discontinue use of the product until mitigations are available.
   • Perform a targeted review of your SharePoint access paths (especially paths reachable from the internet) as part of the CISA BOD 26-04 guidance.

5. Validate after changes

   • Re-check the SharePoint build number after patching to confirm you reached the fixed version.
   • Review operational logs and alerts for unusual SharePoint activity around the time period of patching (especially behavior consistent with authenticated abuse by low-privilege accounts).

6. CISA deadline to plan around

   • CISA remediation due date for this KEV item is 2026-07-04.

7. Ongoing monitoring

   • Continue monitoring for new SharePoint-related alerts and unexpected changes to content, permissions, or server behavior, since exploitation is confirmed in the wild.

Severity and status: High-risk remote code execution, confirmed in the CISA KEV catalog with active exploitation (CISA added it on 2026-07-01; remediation due 2026-07-04). Exploit maturity appears high enough for real-world use, despite no public exploit code being recorded.

Mechanism: The weakness is CWE-502 (Deserialization of Untrusted Data). The technical description indicates that Microsoft SharePoint Office-related functionality can deserialize untrusted data, enabling an authenticated attacker to execute code over the network.

Attack prerequisites / vector: Exploitation is reported as involving an authenticated attacker with minimal permissions (Site Member). This means the key risk condition is not “random internet visitors,” but rather an attacker obtaining or already having a low-privilege SharePoint account. CISA also emphasizes evaluating internet exposure for each asset.

CVE linkage and patching: Microsoft patched the vulnerability in May 2026; fixed builds are provided per product (16.0.19725.20280 for SharePoint Server and Subscription Edition; 16.0.5552.1002 for SharePoint Enterprise Server 2016; 16.0.10417.20128 for SharePoint Server 2019). KEV means the practical priority should be patching and mitigations rather than waiting for predictions.

EPSS note: EPSS is a prediction and is not used to drive the response priority here because KEV/news confirm exploitation.