CVE-2026-45659: Microsoft SharePoint Server -- Deserialization RCE

Background

Microsoft SharePoint Server is being actively exploited via a deserialization vulnerability that allows an authenticated attacker — one with basic Contribute-level site permissions — to execute arbitrary code on the server. CISA added CVE-2026-45659 to the Known Exploited Vulnerabilities catalog on July 1, 2026, and has set a federal agency patching deadline of July 4, 2026. Patches were available from Microsoft as of the May 2026 Patch Tuesday, meaning any unpatched on-premises SharePoint deployment has been exposed for over six weeks since the fix shipped.

CVE-2026-45659 is a CWE-502 (Deserialization of Untrusted Data) vulnerability in Microsoft SharePoint Server. It carries a CVSS 3.1 base score of 8.8 (High), with attack vector Network, attack complexity Low, and privileges required Low — meaning any authenticated user with edit rights on a SharePoint site is a potential threat actor. The vulnerability does not require administrator privileges, does not require user interaction, and the CISA description confirms exploitation over a network is possible.

The vulnerability exists in the on-premises product lines only. SharePoint Online (Microsoft 365) is not affected.

CISA’s KEV addition confirms exploitation is occurring in the wild. No specific attribution to named threat actors or campaigns has been published as of this writing, but the rapid KEV addition — within weeks of the original patch — indicates active targeting.

Technical Mechanism

SharePoint Server’s data processing pipelines handle serialized object graphs in several content-processing and list-management code paths. The CWE-502 classification indicates the root cause is insufficient validation of attacker-controlled serialized data before deserialization occurs. In practice, this class of vulnerability means an attacker can craft a malicious payload that, when deserialized by the server-side process, instantiates or invokes objects in ways that execute arbitrary code.

The attack requires at minimum Contribute-level permissions — the ability to create and edit list items or library documents. This is a common permission level granted to staff members who need to use SharePoint for document management, team sites, or project workspaces. It does not require site collection administrator access, farm administrator access, or any elevated privilege beyond basic content-editing rights.

The attack vector is network-accessible, meaning exploitation does not require physical or local access to the server. An attacker who has obtained valid Contribute-level credentials — whether through phishing, credential stuffing, or insider access — can trigger the vulnerability directly via the SharePoint API or web interface without additional lateral movement.

A public proof-of-concept for this vulnerability has been circulating, which is consistent with CISA’s prioritisation of the KEV deadline at July 4, three days after catalog addition.

Real-World Exploitation Evidence

CISA’s addition of CVE-2026-45659 to the KEV catalog on July 1, 2026 is the authoritative confirmation of active exploitation. The catalog requires “reliable evidence that the CVE has been exploited in the wild.”

The rapid timeline from patch availability (May 2026) to KEV addition (July 1, 2026) without a major public disclosure event suggests exploitation was observed in targeted operations rather than a broad opportunistic campaign. SharePoint Server is a high-value target in enterprise environments: it typically holds internal documentation, contracts, HR records, financial data, and collaboration content. Code execution in the SharePoint process context would allow an attacker to access this data directly from memory, exfiltrate documents, or establish persistence on the host.

The combination of low privilege requirement, no user interaction, and public PoC availability creates conditions for rapid spread to opportunistic ransomware operators, who have historically shown significant interest in SharePoint and Exchange vulnerabilities as initial access vectors.

Impact Assessment

• Authenticated RCE with low privilege bar: Any user with Contribute-level site access — a standard permission for content contributors — can execute arbitrary code on the server
• Access to sensitive content: SharePoint hosts internal documents, contracts, financial data, and collaboration records; code execution provides direct in-process access to all content
• Persistence and lateral movement: Code execution in the IIS worker process context allows creation of web shells, staging of additional tooling, and network pivoting from the SharePoint host
• Ransomware staging: SharePoint vulnerabilities are an established initial access vector for ransomware operators; the public PoC lowers the technical barrier for opportunistic actors
• Enterprise-wide blast radius: In organisations with large SharePoint farms, a single exploited server with Contribute access can lead to farm-wide compromise if the attacker can escalate to farm administrator

Affected Versions

The vulnerability affects all on-premises SharePoint Server editions:

SharePoint Server 2013 and earlier are past Microsoft’s extended support lifecycle and have not received patches; organisations running those versions should assume exposure.

SharePoint Online / Microsoft 365 is not affected.

The Microsoft Security Response Center advisory (linked in References) provides the specific build numbers and cumulative update identifiers required for each product line.

Remediation Steps

1. Apply the May 2026 Cumulative Updates immediately. The patches cover all three affected product lines. Federal agencies are required under BOD 26-04 to apply mitigations by July 4, 2026 — private sector organisations should treat this deadline as relevant regardless of regulatory obligation.

2. Verify the patch applied correctly. SharePoint cumulative update failures are common and often silent. Use SharePoint Management Shell to confirm the installed build:

   Get-SPFarm | Select BuildVersion

   Compare the output against the patched build number in the MSRC advisory.

3. If patching is not immediately possible:

   • Review and restrict Contribute-level permission grants; remove permissions from accounts that do not need them, particularly external users and service accounts
   • Disable external access to SharePoint Server from the internet if the deployment is not legitimately internet-facing
   • Implement network-level controls to restrict which systems can reach SharePoint Server APIs
   • Monitor authentication logs for unusual patterns from accounts with Contribute access

There is no known workaround that fully mitigates this vulnerability without applying the patch. Permission reduction reduces the attacker pool but does not eliminate the vulnerability.

Detection Guidance

Log sources to monitor:

• SharePoint Unified Logging Service (ULS) logs: Look for errors or unusual activity in the SharePoint data processing pipelines, particularly around list item update operations. ULS logs are located at %CommonProgramFiles%\Microsoft Shared\Web Server Extensions\16\LOGS\
• Windows Event Log (Application/Security): Unexpected process spawning from w3wp.exe (the IIS worker process hosting SharePoint) is a strong indicator of successful exploitation. Child processes of w3wp.exe that are not normally expected (cmd.exe, powershell.exe, cscript.exe) warrant immediate investigation
• IIS logs (W3SVC): Review for unusual patterns of POST requests to SharePoint REST API or CSOM endpoints from accounts with Contribute access, particularly at unexpected hours or from unexpected IP addresses
• Windows Defender / EDR telemetry: Detections for serialization-based exploit gadget chains (e.g., ActivitySurrogate, TypeConfuseDelegate patterns) in the w3wp.exe process context are relevant

Indicators of Compromise:

At time of writing, no published IOC sets have been attributed to this CVE specifically. Security teams should watch for:

• Unexpected outbound network connections from the SharePoint server host
• New scheduled tasks, services, or registry run keys created by IIS worker processes
• File creation or modification in SharePoint web root directories by processes other than the SharePoint update installer

Given the public PoC availability, commercial threat intelligence and EDR vendors are likely to release signatures shortly. Update detection rules as vendor releases become available.

Timeline

References

• Microsoft Security Response Center: CVE-2026-45659
• NVD: CVE-2026-45659
• CISA Known Exploited Vulnerabilities Catalog
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• Microsoft SharePoint Server Update History