CISA Warns of Actively Exploited Microsoft SharePoint RCE Vulnerability

The Cybersecurity and Infrastructure Security Agency has added a critical remote code execution vulnerability in Microsoft SharePoint Server to its Known Exploited Vulnerabilities catalog. The flaw, tracked as CVE-2026-45659, is being actively exploited and poses a significant risk to organizations running unpatched SharePoint servers.

CISA added the flaw to its KEV catalog on July 1, 2026, giving Federal Civilian Executive Branch agencies until July 4, 2026 to patch under binding operational directive requirements. Private sector organizations are strongly encouraged to apply Microsoft's security updates as quickly as possible.

What Happened: CVE-2026-45659 Added to CISA's KEV Catalog

CISA added CVE-2026-45659 to the KEV catalog after confirming active exploitation in the wild. The vulnerability is a remote code execution flaw in Microsoft SharePoint Server caused by deserialization of untrusted data. Microsoft had addressed the flaw in its May 2026 security updates.

The vulnerability carries a CVSS score of 8.8, indicating high severity. Successful exploitation lets any authenticated attacker with minimum Site Member permissions execute arbitrary code on affected SharePoint servers, without needing admin or other elevated privileges.

Key Details

SharePoint Server is widely deployed in enterprise environments for document management and collaboration. A remote code execution vulnerability in this platform is particularly dangerous because SharePoint servers typically contain sensitive business documents and integrate with other enterprise systems.

Deserialization vulnerabilities occur when applications unsafely process serialized data from untrusted sources. Attackers can craft malicious serialized objects that execute code when deserialized by the vulnerable application.

Serialization is the process of converting an in-memory object, like a user session or a configuration setting, into a format that can be stored or transmitted, and deserialization reverses that process to reconstruct the object. The danger arises when an application deserializes data without verifying it actually came from a trusted source and hasn't been tampered with: a well-crafted malicious payload can instruct the deserialization process to instantiate objects and execute methods the application never intended to run, effectively hijacking a normal data-processing step to run arbitrary attacker-controlled code. This class of vulnerability is particularly dangerous precisely because it doesn't require finding a memory-corruption bug or bypassing authentication outright, it abuses application logic that was working as designed, just without adequate validation of its input.

Who Is Behind the Attacks

Security researchers have since attributed part of the exploitation campaign to Storm-2603, a threat actor with a track record of deploying Warlock ransomware by exploiting known vulnerabilities in on-premises SharePoint servers going back to mid-2025. Security vendor Imperva reported more than 60,000 exploitation attempts against SharePoint servers in a single day at the campaign's peak, with over half of the observed attempts targeting organizations in the United States. In observed intrusions, attackers have used the initial SharePoint access to move laterally across internal networks, establish persistence through legitimate remote-access tools, and escalate privileges up to domain administrator before deploying ransomware, a pattern that goes well beyond a single compromised server.

Why It Matters

Active exploitation of a SharePoint RCE vulnerability means that attackers are already using it to compromise organizations. Any organization running unpatched SharePoint Server is at immediate risk.

The CISA KEV catalog addition is significant because it reflects confirmed real-world exploitation, not just theoretical risk. Federal agencies face mandatory patching timelines, and the inclusion serves as a strong signal to all organizations about the urgency. This isn't a hypothetical: this exact flaw was one of the systems attackers reached in the breach of DHS's Homeland Security Information Network, confirmed the same day CISA added it to the KEV catalog.

Industry Context

Microsoft SharePoint has been a frequent target for attackers due to its widespread deployment and the valuable data it contains. Previous SharePoint vulnerabilities have been exploited by nation-state actors and ransomware groups to gain initial access to enterprise networks.

The escalation path Imperva and other researchers observed, initial SharePoint access to lateral movement to domain administrator to ransomware deployment, follows a well-established pattern in modern intrusions rather than anything specific to this vulnerability. Domain administrator credentials grant control over an organization's entire Windows network, not just the single compromised server, which is why attackers prioritize escalating to that level before deploying ransomware: encrypting files from a domain admin position lets them reach far more systems at once than staying confined to the initially breached SharePoint server ever would. That's also why patching the SharePoint vulnerability alone, after an intrusion has already progressed to domain admin, isn't sufficient remediation; organizations that discover they were compromised need a full incident-response process covering credential resets and network-wide review, not just the single patch.

CISA's KEV catalog has become a key resource for vulnerability prioritization. Security teams increasingly use KEV inclusion as a primary signal for which patches to apply first.

What It Means for Users and the Industry

For SharePoint administrators, immediate patching is essential. Organizations should verify that their SharePoint installations have received the May 2026 security updates. If patching is delayed, temporary mitigations such as restricting SharePoint access may be necessary.

For the broader security community, this vulnerability reinforces the importance of timely patch management for internet-facing enterprise applications.

What Happens Next

Microsoft has already released patches. CISA will monitor compliance from federal agencies. Attackers will likely continue exploiting unpatched systems until the vulnerable population shrinks significantly.

Final Takeaway

CVE-2026-45659 is a serious, actively exploited vulnerability in a widely deployed enterprise platform. Organizations running SharePoint Server should treat patching as a critical priority.

Key Points

SharePoint as an Attack Target

Microsoft SharePoint Server is an attractive target for attackers because it is widely deployed in enterprises and contains valuable business documents. A successful compromise can provide access to intellectual property, financial records, strategic plans, and employee information. SharePoint's integration with other Microsoft services also means that a SharePoint compromise can serve as a pivot point to broader network access.

The deserialization vulnerability in CVE-2026-45659 is dangerous because it requires only low-level access: any authenticated attacker with minimum Site Member permissions, not admin or other elevated rights, can trigger it. That low bar makes it practical for attackers who obtain or purchase low-privilege credentials through phishing or credential stuffing, rather than a vulnerability requiring no authentication at all.

Organizations should also review their SharePoint configurations to ensure that servers are not unnecessarily exposed to the internet. SharePoint installations intended for internal use should be accessible only from internal networks or through VPN connections.

FAQs