CISA Adds High-Severity SharePoint RCE Vulnerability (CVE-2026-45659) to KEV Catalog Amid Active Exploitation

Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert by adding CVE-2026-45659, a high-severity remote code execution (RCE) vulnerability in Microsoft SharePoint Server, to its Known Exploited Vulnerabilities (KEV) catalog. This action was taken due to confirmed evidence of active exploitation in the wild. The vulnerability, which carries a CVSS score of 8.8, allows an authenticated attacker with low-level permissions to execute arbitrary code on a target server. In response, CISA has issued a Binding Operational Directive (BOD) requiring all Federal Civilian Executive Branch (FCEB) agencies to apply the necessary security updates by July 4, 2026. Given SharePoint's widespread use for data storage and collaboration, this vulnerability presents a significant and immediate threat to both public and private sector organizations.

Vulnerability Details

The vulnerability, identified as CVE-2026-45659, is a remote code execution flaw resulting from the insecure deserialization of untrusted data within Microsoft SharePoint Server. An attacker must be authenticated to the target SharePoint site with at least Site Member permissions to exploit this flaw. This low privilege requirement makes the vulnerability particularly dangerous, as a compromise of any basic user account could lead to a full server takeover.

According to Microsoft, the attack complexity is low, meaning an adversary can achieve repeatable success without deep technical knowledge of the target environment. By sending a specially crafted request to a vulnerable SharePoint server, an attacker can trigger the deserialization of a malicious object, leading to code execution in the context of the SharePoint application pool process.

Affected Systems

The vulnerability affects the following Microsoft SharePoint Server versions:

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Enterprise Server 2016

Microsoft released out-of-band security updates in late May 2026 to address this issue.

Exploitation Status

As of July 1, 2026, CVE-2026-45659 is being actively exploited in the wild. CISA's inclusion of the vulnerability in the KEV catalog confirms these reports. While specific details about the threat actors or their objectives have not been publicly disclosed, the exploitation of SharePoint vulnerabilities is a common tactic for initial access, data exfiltration, and lateral movement, often as a precursor to ransomware deployment.

Impact Assessment

A successful exploit of CVE-2026-45659 could have a devastating impact on an organization. Attackers could gain complete control over the SharePoint server, allowing them to:

• Access, modify, or exfiltrate all data stored on the platform, including sensitive documents, intellectual property, and personally identifiable information (PII).
• Deploy malware, such as web shells or ransomware, onto the server.
• Use the compromised server as a pivot point to move laterally within the corporate network.
• Disrupt business operations by taking the SharePoint service offline.

Given that SharePoint often integrates with other critical business systems, the blast radius of a compromise can be extensive, leading to significant financial loss, reputational damage, and regulatory penalties.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Detection Methods

Security teams should implement the following detection strategies:

1. Vulnerability Scanning: Use vulnerability management tools to scan for and identify all SharePoint servers missing the required security updates for CVE-2026-45659.
2. Log Analysis: Ingest SharePoint ULS logs, Windows Event Logs, and web server logs into a SIEM. Create detection rules to alert on suspicious activity, such as the w3wp.exe process spawning command shells, as mentioned in the observables. This aligns with D3FEND's Process Analysis (D3-PA).
3. Endpoint Detection and Response (EDR): Ensure EDR agents are deployed on all SharePoint servers. Use EDR to monitor process execution, file modifications, and network connections, providing high-fidelity alerts on post-exploitation activity.
4. Network Traffic Analysis: Monitor network traffic to and from SharePoint servers for anomalies. This includes looking for connections to known malicious IP addresses or unusual data transfer patterns, in line with D3FEND's Network Traffic Analysis (D3-NTA).

Remediation Steps

Due to active exploitation, immediate action is required.

1. Patch Immediately: The primary remediation is to apply the security updates released by Microsoft in May 2026. Prioritize patching internet-facing SharePoint servers first, followed by internal servers.
2. Verify Patch Installation: After deployment, confirm that the patches have been successfully installed on all affected assets.
3. Assume Compromise: For any unpatched systems, especially those exposed to the internet, security teams should assume they may be compromised and initiate threat hunting activities to search for signs of malicious activity.
4. Harden Configurations: As a general best practice, review and harden SharePoint server configurations. This includes implementing the principle of least privilege for service accounts and restricting network access to the server, a D3FEND Application Hardening (D3-AH) technique.