CVE-2026-45659

This is a security hole in Microsoft SharePoint Server where a bad actor can cause SharePoint to run attacker-chosen code. A common real-world path is that the attacker already has a low-level SharePoint account, such as a Site Member, and uses it to get control. If successful, they can potentially take over the server and access or alter your business files stored in SharePoint.

This matters if you run any of these products: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server Subscription Edition, Microsoft SharePoint Server, or Microsoft SharePoint Server 2019. Because exploitation involves an authenticated attacker with minimal permissions (Site Member), you should focus on whether someone could realistically reach SharePoint with a low-privilege account. CISA also directs owners to evaluate each asset’s internet exposure; the risk is higher when SharePoint is reachable from the internet and attackers can obtain or already have SharePoint access.

This is RED because CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) catalog with evidence of active exploitation, meaning attackers are already using it in the real world. Patch quickly to the fixed SharePoint builds listed by Microsoft, and treat the CISA remediation deadline as the minimum standard.