SharePoint RCE Flaw CVE-2026-45659 Confirmed Under Active Attack, Added to CISA's KEV List

CVE-2026-45659 is a remote code execution vulnerability in on-premises SharePoint, rated CVSS 8.8, and it’s now confirmed under active exploitation. CISA added it to the Known Exploited Vulnerabilities catalog on July 1, with a remediation deadline of July 4 for federal civilian agencies — a three-day window that reflects how urgent the agency considers this.

Affected versions: SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. SharePoint Online (Microsoft 365) is not affected — this is an on-prem-only bug.

What it allows: The flaw is a deserialization-of-untrusted-data vulnerability. An attacker who already holds nothing more than Site Member permissions — no admin access required — can craft a malicious serialized payload that SharePoint deserializes and executes as code, over the network. Low privilege bar, network-based attack vector, no user interaction needed: that combination is why it scores 8.8 rather than lower.

The disclosure gap: Microsoft actually patched this vulnerability back in its May 2026 update — but classified exploitation as “Less Likely” and didn’t flag it as a priority at the time. CISA’s KEV addition on July 1 confirms real-world attackers disagreed with that assessment. Specifics on the threat actors or attack campaigns behind the exploitation haven’t been disclosed.

The fix: If you’re running any of the three affected on-prem versions, confirm you have the May 2026 cumulative update installed — that’s the patch that closes this hole. If you can’t verify patch status immediately, treat internet-facing SharePoint farms as compromised-until-proven-otherwise and check IIS and SharePoint ULS logs for anomalous deserialization errors or unexpected w3wp.exe child processes, a common RCE-via-deserialization indicator. Federal agencies are already past their CISA deadline; everyone else should treat July 4 as the deadline that already passed and patch immediately if you haven’t.

This is the second time in recent memory a vendor’s “less likely to be exploited” rating has aged badly within weeks. If your organization uses Microsoft’s exploitability index to triage patch priority, this is a case for re-scoring anything touching deserialization or authenticated RCE paths higher than the vendor’s own label — those bug classes have a track record of getting weaponized faster than initial assessments suggest.

Sources

• SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation