# CVE-2026-45659: Microsoft SharePoint Server Deserialization RCE Added to CISA KEV

> CVE-2026-45659 is a CWE-502 unsafe deserialization vulnerability in on-premises Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, Subscription Edition) that lets an authenticated attacker with only Site Member permissions achieve remote code execution over the network with no user interaction. CISA added it to the KEV catalog on 2026-07-01, confirming active exploitation, with a federal remediation deadline of 2026-07-04.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1065
- **ID:** TL-2026-1065
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-45659, CVE-2026-32201

## Description

CVE-2026-45659 is a remote code execution vulnerability in on-premises Microsoft SharePoint Server caused by deserialization of untrusted data (CWE-502). SharePoint can be coerced into processing attacker-controlled serialized objects submitted through an authenticated site context; because .NET/SharePoint deserialization gadget chains can instantiate arbitrary objects and invoke methods during deserialization, a crafted payload can result in arbitrary code execution in the context of the SharePoint application pool. Unlike many prior SharePoint RCE bugs (e.g. the 2025 'ToolShell' chain, CVE-2025-49706/CVE-2025-49704) which combined an authentication-bypass/spoofing primitive with a deserialization gadget to reach unauthenticated RCE, CVE-2026-45659 requires the attacker to already hold valid SharePoint credentials with low privilege (Site Member, PR:L) — no administrative rights, and no user interaction, are required to trigger the flaw.

Microsoft rated the vulnerability CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and shipped fixes as part of the May 2026 Patch Tuesday cycle (published 2026-05-22, with an update/clarification issued 2026-05-27 for build-number scoping; a small number of vendors' initial coverage suggested a later out-of-band re-release was needed for full effect). Fixed builds are SharePoint Enterprise Server 2016 >= 16.0.5552.1002, SharePoint Server 2019 >= 16.0.10417.20128, and SharePoint Server Subscription Edition >= 16.0.19725.20280. SharePoint Online (Microsoft 365) is not affected — the flaw is confined to on-premises/hybrid farm deployments.

Microsoft's original exploitability assessment tagged the bug 'Exploitation Less Likely' and no public proof-of-concept or technical gadget-chain writeup was available at disclosure. That assessment was overtaken by events: on 2026-07-01 CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) catalog, confirming it is being actively exploited in the wild, and set a Federal Civilian Executive Branch (FCEB) remediation deadline of 2026-07-04 under BOD 22-01. No public source has yet attributed the July 2026 in-the-wild exploitation of CVE-2026-45659 specifically to a named threat actor or malware family.

The vulnerability sits in a well-documented pattern of recurring on-prem SharePoint deserialization/authentication-chain weaknesses. It is frequently discussed alongside CVE-2026-32201, an unauthenticated spoofing/XSS flaw in the same SharePoint versions (patched 2026-04-14, CVSS 6.5, also KEV-listed) that researchers describe as a plausible credential-theft precursor: an attacker could use CVE-2026-32201 to steal a low-privilege employee session/credential via reflected XSS, then pivot into CVE-2026-45659 to reach full remote code execution on the farm server — a 'chain to RCE' scenario analogous to the 2025 ToolShell chain. Separately, the broader on-prem SharePoint threat landscape in the 2025-2026 window has been dominated by the China-nexus, ransomware-affiliated actor Storm-2603 (aka Warlock Group / GOLD SALEM), which has repeatedly weaponized SharePoint deserialization/auth-bypass chains (ToolShell: CVE-2025-49706, CVE-2025-49704) to drop ASPX web shells (spinstall0.aspx family), a custom AK47 C2 framework (AK47HTTP/AK47DNS clients), and ultimately Warlock/X2anylock and LockBit Black ransomware, using BYOVD (e.g. vulnerable NSecKrnl.sys driver), Velociraptor abuse for defense evasion, and Cloudflare-tunnel/Zoho Assist/VS Code SSH for covert remote access. This prior campaign activity is documented here as essential defender context for prioritizing detection and hardening around on-prem SharePoint deserialization bugs generally, but is NOT asserted as confirmed attribution for the July 2026 CVE-2026-45659 exploitation observed by CISA.

Because exploitation requires only low-privilege authenticated access and no user interaction, and because on-prem SharePoint farms are frequently internet-exposed for extranet/partner collaboration, defenders should treat any authenticated user (including compromised low-privilege service or contractor accounts) as a potential RCE vector until patched.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1505.003 Web Shell
- T1136.001 Local Account
- T1136.002 Domain Account
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1539 Steal Web Session Cookie
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1087 Account Discovery
- T1021.004 SSH
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1071.004 DNS
- T1071.001 Web Protocols
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery

## Sources

- [CISA SharePoint RCE CVE-2026-45659 (SOCRadar)](https://socradar.io/blog/cisa-sharepoint-rce-cve-2026-45659/)
- [SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation](https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html)
- [Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions](https://thehackernews.com/2026/05/microsoft-patches-sharepoint-rce-flaw.html)
- [High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659)](https://www.helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659/)
- [CVE-2026-45659 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-45659)
- [Microsoft Security Update Guide: CVE-2026-45659](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659)
- [SharePoint Under Double Active Threat: CVE-2026-32201 Zero-Day Still Exploited While Microsoft Releases New RCE (CVE-2026-45659)](https://www.apolocybersecurity.com/en/blog-posts/sharepoint-double-threat-cve-2026-32201-zero-day-cve-2026-45659-rce)
- [Microsoft SharePoint Has a New RCE Flaw. If You Haven't Patched Yet, Go Do That.](https://securityaffairs.com/192730/security/microsoft-sharepoint-has-a-new-rce-flaw-if-you-havent-patched-yet-go-do-that.html)
- [Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 (it-connect)](https://www.it-connect.tech/microsoft-patches-sharepoint-rce-flaw-cve-2026-45659/)
- [Storm-2603 Deploys DNS-Controlled Backdoor in Warlock and LockBit Ransomware Attacks](https://thehackernews.com/2025/08/storm-2603-exploits-sharepoint-flaws-to.html)
- [Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks](https://unit42.paloaltonetworks.com/ak47-activity-linked-to-sharepoint-vulnerabilities/)
- [Storm-2603: Hybrid Espionage and Ransomware Operations Exploiting SharePoint ToolShell Vulnerabilities](https://blog.alphahunt.io/storm-2603-hybrid-espionage-and-ransomware-operations-exploiting-sharepoint-toolshell-vulnerabilities/)
- [SharePoint ToolShell Exploitation, Campaign C0058 - MITRE ATT&CK](https://attack.mitre.org/campaigns/C0058/)
- [Velociraptor Misuse, Pt. II: The Eye of the Storm](https://www.huntress.com/blog/velociraptor-misuse-part-two-eye-of-the-storm)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1065