Threat reportVulnerabilityTL-2026-1065
CVE-2026-45659: Microsoft SharePoint Server Deserialization RCE Added to CISA KEV
CVE-2026-45659 (TL-2026-1065) is a high-severity software vulnerability scored CVSS 8.8, first published 2026-07-02. It has no confirmed attribution, affects Microsoft SharePoint Enterprise Server 2016, references 2 CVEs (CVE-2026-45659, CVE-2026-32201), maps to 26 MITRE ATT&CK techniques (T1003, T1005, T1021.004), and is covered by 9 detection rules and 18 indicators of compromise.
- CVSS
- 8.8/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 26MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-1065
- Threat ID
- TL-2026-1065
- Severity
- HIGH
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, education, technology, manufacturing
- Target regions
- North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in CVE-2026-45659
Malware and tooling: LockBit 3.0 - S1202, Warlock / X2anylock, AK47 C2 (AK47HTTP / AK47DNS), Velociraptor
How CVE-2026-45659 works
CVE-2026-45659 is a CWE-502 unsafe deserialization vulnerability in on-premises Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, Subscription Edition) that lets an authenticated attacker with only Site Member permissions achieve remote code execution over the network with no user interaction. CISA added it to the KEV catalog on 2026-07-01, confirming active exploitation, with a federal remediation deadline of 2026-07-04.
CVE-2026-45659 is a remote code execution vulnerability in on-premises Microsoft SharePoint Server caused by deserialization of untrusted data (CWE-502). SharePoint can be coerced into processing attacker-controlled serialized objects submitted through an authenticated site context; because .NET/SharePoint deserialization gadget chains can instantiate arbitrary objects and invoke methods during deserialization, a crafted payload can result in arbitrary code execution in the context of the SharePoint application pool. Unlike many prior SharePoint RCE bugs (e.g. the 2025 'ToolShell' chain, CVE-2025-49706/CVE-2025-49704) which combined an authentication-bypass/spoofing primitive with a deserialization gadget to reach unauthenticated RCE, CVE-2026-45659 requires the attacker to already hold valid SharePoint credentials with low privilege (Site Member, PR:L) — no administrative rights, and no user interaction, are required to trigger the flaw.
Microsoft rated the vulnerability CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and shipped fixes as part of the May 2026 Patch Tuesday cycle (published 2026-05-22, with an update/clarification issued 2026-05-27 for build-number scoping; a small number of vendors' initial coverage suggested a later out-of-band re-release was needed for full effect). Fixed builds are SharePoint Enterprise Server 2016 >= 16.0.5552.1002, SharePoint Server 2019 >= 16.0.10417.20128, and SharePoint Server Subscription Edition >= 16.0.19725.20280. SharePoint Online (Microsoft 365) is not affected — the flaw is confined to on-premises/hybrid farm deployments.
Microsoft's original exploitability assessment tagged the bug 'Exploitation Less Likely' and no public proof-of-concept or technical gadget-chain writeup was available at disclosure. That assessment was overtaken by events: on 2026-07-01 CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) catalog, confirming it is being actively exploited in the wild, and set a Federal Civilian Executive Branch (FCEB) remediation deadline of 2026-07-04 under BOD 22-01. No public source has yet attributed the July 2026 in-the-wild exploitation of CVE-2026-45659 specifically to a named threat actor or malware family.
The vulnerability sits in a well-documented pattern of recurring on-prem SharePoint deserialization/authentication-chain weaknesses. It is frequently discussed alongside CVE-2026-32201, an unauthenticated spoofing/XSS flaw in the same SharePoint versions (patched 2026-04-14, CVSS 6.5, also KEV-listed) that researchers describe as a plausible credential-theft precursor: an attacker could use CVE-2026-32201 to steal a low-privilege employee session/credential via reflected XSS, then pivot into CVE-2026-45659 to reach full remote code execution on the farm server — a 'chain to RCE' scenario analogous to the 2025 ToolShell chain. Separately, the broader on-prem SharePoint threat landscape in the 2025-2026 window has been dominated by the China-nexus, ransomware-affiliated actor Storm-2603 (aka Warlock Group / GOLD SALEM), which has repeatedly weaponized SharePoint deserialization/auth-bypass chains (ToolShell: CVE-2025-49706, CVE-2025-49704) to drop ASPX web shells (spinstall0.aspx family), a custom AK47 C2 framework (AK47HTTP/AK47DNS clients), and ultimately Warlock/X2anylock and LockBit Black ransomware, using BYOVD (e.g. vulnerable NSecKrnl.sys driver), Velociraptor abuse for defense evasion, and Cloudflare-tunnel/Zoho Assist/VS Code SSH for covert remote access. This prior campaign activity is documented here as essential defender context for prioritizing detection and hardening around on-prem SharePoint deserialization bugs generally, but is NOT asserted as confirmed attribution for the July 2026 CVE-2026-45659 exploitation observed by CISA.
Because exploitation requires only low-privilege authenticated access and no user interaction, and because on-prem SharePoint farms are frequently internet-exposed for extranet/partner collaboration, defenders should treat any authenticated user (including compromised low-privilege service or contractor accounts) as a potential RCE vector until patched.
MITRE ATT&CK techniques used in TL-2026-1065
Credential Access
T1003 OS Credential Dumping; T1539 Steal Web Session Cookie
Collection
Lateral Movement
T1021.004 SSH; T1210 Exploitation of Remote Services
Defense Evasion
T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth
Execution
T1059 Command and Scripting Interpreter; T1059.001 PowerShell; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts
Command and Control
T1071.001 Web Protocols; T1071.004 DNS; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Discovery
T1082 System Information Discovery; T1087 Account Discovery
Persistence
T1136.001 Local Account; T1136.002 Domain Account; T1505.003 Web Shell
Impact
T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery
defense-impairment
Affected products and versions in CVE-2026-45659
- Microsoft — SharePoint Enterprise Server 2016
Vulnerable versions: < 16.0.5552.1002
Fixed in: 16.0.5552.1002 and later - Microsoft — SharePoint Server 2019
Vulnerable versions: < 16.0.10417.20128
Fixed in: 16.0.10417.20128 and later - Microsoft — SharePoint Server Subscription Edition
Vulnerable versions: < 16.0.19725.20280
Fixed in: 16.0.19725.20280 and later
Remediation for CVE-2026-45659
Patches
- Microsoft May 2026 (2026-05-22) security update for SharePoint Enterprise Server 2016 — build 16.0.5552.1002
- Microsoft May 2026 (2026-05-22) security update for SharePoint Server 2019 — build 16.0.10417.20128
- Microsoft May 2026 (2026-05-22) security update for SharePoint Server Subscription Edition — build 16.0.19725.20280
- Microsoft clarification/re-issued guidance 2026-05-27 confirming customers already on the May 2026 update require no further action
Immediate actions
- Apply the May 2026 Microsoft security updates to all on-premises SharePoint farm servers immediately; confirm the 2026-05-27 clarification update is also applied where relevant
- Verify installed build numbers meet or exceed: SharePoint Enterprise Server 2016 16.0.5552.1002, SharePoint Server 2019 16.0.10417.20128, SharePoint Server Subscription Edition 16.0.19725.20280
- If patching cannot occur before 2026-07-04, restrict internet exposure of on-prem SharePoint via VPN/zero-trust access and disable external-facing endpoints
- Audit all authenticated Site Member accounts for anomalous activity, credential reuse, and recent access from unfamiliar IPs/geographies
- Review IIS logs, ULS logs, and w3wp.exe process trees on all SharePoint front-end and app servers for the preceding 60+ days for signs of deserialization exploitation or webshell drops
- Rotate SharePoint farm service account credentials and machine keys if compromise is suspected
Workarounds
- Restrict or disable internet-facing access to on-prem SharePoint servers until patched
- Enforce MFA and conditional access for all SharePoint authenticated users to reduce risk of the low-privilege-account entry vector
- Disable or tightly monitor Site Member self-service permissions where not operationally required
Longer-term hardening
- Deploy EDR/behavioral detection on all SharePoint servers with alerting on w3wp.exe spawning cmd.exe/powershell.exe/csc.exe
- Establish a SharePoint-specific expedited patch cadence independent of general Patch Tuesday rollout given the recurring high-severity pattern in this product line
- Segment on-prem SharePoint farms from sensitive internal networks; apply least-privilege to Site Member and Site Owner roles
- Enable and monitor Antimalware Scan Interface (AMSI) integration for SharePoint
- Threat-hunt for AK47 C2, Warlock/X2anylock, and BYOVD/Velociraptor-abuse indicators given the broader on-prem SharePoint exploitation landscape
CVEs associated with CVE-2026-45659
Weaknesses (CWE) in CVE-2026-45659
Timeline of CVE-2026-45659
- Microsoft patches CVE-2026-32201 (SharePoint spoofing/XSS, CVSS 6.5), later cited as a plausible credential-theft precursor to CVE-2026-45659; added to CISA KEV the same month.
- Researchers note a similar authentication-bypass-to-RCE pattern in Exchange OWA (CVE-2026-42897), drawing comparison to the SharePoint chain under analysis.
- CVE-2026-45659 publicly disclosed and published to NVD/MSRC as part of Microsoft's May 2026 Patch Tuesday release.
- Security press (The Hacker News, SecurityAffairs, it-connect) publishes technical coverage of the SharePoint RCE patch across all three affected server editions.
- Help Net Security publishes detailed analysis confirming affected build numbers and noting Microsoft's initial 'Exploitation Less Likely' assessment and absence of public PoC.
- Microsoft issues clarification confirming customers who already applied the May 2026 cumulative update do not need further action; affected version ranges further clarified.
- Independent research (Apolo Cybersecurity) publishes a combined-risk analysis describing how CVE-2026-32201 could be chained with CVE-2026-45659 to achieve unauthenticated-to-RCE compromise.
- Affected version ranges for CVE-2026-45659 further clarified/confirmed across vendor and aggregator write-ups.
- CISA adds CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild and setting a remediation due date.
- NVD record for CVE-2026-45659 last modified, reflecting KEV status and updated references.
- SOCRadar publishes blog coverage of the CISA KEV addition, the source article that triggered this threat record.
- CISA-mandated remediation deadline for U.S. Federal Civilian Executive Branch (FCEB) agencies to patch CVE-2026-45659 under Binding Operational Directive 22-01.
Sources cited for CVE-2026-45659
- CISA SharePoint RCE CVE-2026-45659 (SOCRadar)
- SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
- Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions
- High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659)
- CVE-2026-45659 Detail - NVD
- Microsoft Security Update Guide: CVE-2026-45659
- SharePoint Under Double Active Threat: CVE-2026-32201 Zero-Day Still Exploited While Microsoft Releases New RCE (CVE-2026-45659)
- Microsoft SharePoint Has a New RCE Flaw. If You Haven't Patched Yet, Go Do That.
- Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 (it-connect)
- Storm-2603 Deploys DNS-Controlled Backdoor in Warlock and LockBit Ransomware Attacks
- Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
- Storm-2603: Hybrid Espionage and Ransomware Operations Exploiting SharePoint ToolShell Vulnerabilities
- SharePoint ToolShell Exploitation, Campaign C0058 - MITRE ATT&CK
- Velociraptor Misuse, Pt. II: The Eye of the Storm
- CISA Known Exploited Vulnerabilities Catalog
Detection coverage for TL-2026-1065
As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1065 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.