CVE-2026-45659 — Microsoft SharePoint Enterprise Server 2016

As of 2026-05-27, CVE-2026-45659 is a HIGH-severity vulnerability in Microsoft SharePoint Enterprise Server 2016, CVSS v3.1 8.8, EPSS 0.6% (70.4th percentile). Threadlinqs Intelligence links 17 tracked threat campaigns to CVE-2026-45659, most recently “CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV Catalog”.

Last updated: 2026-05-27

What is CVE-2026-45659?

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

The record classifies CVE-2026-45659 under weakness class CWE-502. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs low-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity, availability. 3 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 113 days ago.

Severity and exploitation probability

CVSS v3.1 base score

8.8 — HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

EPSS (FIRST)

0.6% probability of exploitation in the next 30 days, higher than 70.4% of all scored CVEs

CISA KEV

Not listed in the CISA Known Exploited Vulnerabilities catalog

Threadlinqs priority

7.2/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability

Published

2026-05-22, last modified 2026-05-27

Is CVE-2026-45659 being exploited?

It currently carries a trending score of 25 in the Threadlinqs vulnerability feed.

Affected products and versions

• Microsoft: SharePoint Enterprise Server 2016, SharePoint Server 2019, SharePoint Server Subscription Edition

How to fix CVE-2026-45659

No vendor patch reference has been recorded for CVE-2026-45659 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2026-45659

17 tracked threats in the Threadlinqs corpus reference CVE-2026-45659, either in the campaign’s CVE list or as an indicator on the campaign record.

• CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV Catalog — CRITICAL · 2026-07-17
• July 2026 Patch Tuesday: Actively Exploited SharePoint RCE (CVE-2026-58644) and AD FS/SharePoint Zero-Days — CRITICAL · 2026-07-17
• CVE-2026-58644: Microsoft SharePoint Server Unauthenticated Remote Code Execution Exploited in the Wild — CRITICAL · 2026-07-17
• CISA Warns of Active Exploitation of Three Microsoft SharePoint Server Vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) — CRITICAL · 2026-07-15
• CVE-2026-56164: Microsoft SharePoint Server Missing-Authentication Vulnerability Actively Exploited, Added to CISA KEV — CRITICAL · 2026-07-15
• July 2026 Patch Tuesday: Microsoft Fixes 622 CVEs Including Three Actively-Targeted Zero-Days (CVE-2026-56155 AD FS EoP, CVE-2026-56164 SharePoint EoP, CVE-2026-50661 BitLocker Bypass) — CRITICAL · 2026-07-15
• CISA Warns of Trio of Actively Exploited SharePoint Server Flaws (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) — CRITICAL · 2026-07-15
• Microsoft July 2026 Patch Tuesday: 570 Flaws Fixed, 3 Zero-Days Including AD FS and SharePoint Privilege Escalation — CRITICAL · 2026-07-14
• Microsoft July 2026 Patch Tuesday: 569 CVEs, Two Actively Exploited Zero-Days (CVE-2026-56155 AD FS EoP, CVE-2026-56164 SharePoint EoP) — CRITICAL · 2026-07-14
• Microsoft July 2026 Patch Tuesday: Record 622 Flaws Fixed, Two Zero-Days Under Active Exploitation (CVE-2026-56164, CVE-2026-56155) — CRITICAL · 2026-07-14
• CVE-2026-45659: SharePoint Deserialization RCE Added to CISA KEV Amid Storm-2603 Exploitation — HIGH · 2026-07-02
• CVE-2026-45659: Microsoft SharePoint Server Deserialization RCE Added to CISA KEV — HIGH · 2026-07-02
• CVE-2026-45659: Microsoft SharePoint Server Deserialization RCE Actively Exploited, Added to CISA KEV — CRITICAL · 2026-07-02
• CVE-2026-45659: Microsoft SharePoint Deserialization RCE Actively Exploited, Added to CISA KEV — HIGH · 2026-07-02
• CVE-2026-45659: Microsoft SharePoint Deserialization RCE Added to CISA KEV Despite 'Exploitation Less Likely' Rating — HIGH · 2026-07-02
• CISA KEV Addition: Microsoft SharePoint Server Deserialization RCE (CVE-2026-45659) Actively Exploited by Storm-2603 / Warlock Ransomware — CRITICAL · 2026-07-01
• Microsoft SharePoint Authenticated RCE via Deserialization of Untrusted Data (CVE-2026-45659) — HIGH · 2026-05-26

Sources

Seeded from cveorg and not yet processed by the Threadlinqs enrichment pipeline, so blank CVSS, EPSS or KEV fields above mean NOT MEASURED rather than measured-absent.

• msrc.microsoft.com

← all vulnerabilities · Markdown version · Threadlinqs Intelligence