Threat reportVulnerabilityTL-2026-1068
CVE-2026-45659: Microsoft SharePoint Deserialization RCE Actively Exploited, Added to CISA KEV
CVE-2026-45659 (TL-2026-1068) is a high-severity software vulnerability scored CVSS 8.8, first published 2026-07-02. It has no confirmed attribution, affects Microsoft SharePoint Enterprise Server 2016, references 2 CVEs (CVE-2026-45659, CVE-2026-32201), maps to 23 MITRE ATT&CK techniques (T1005, T1021, T1046), and is covered by 9 detection rules and 21 indicators of compromise.
- CVSS
- 8.8/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 23MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 21Indicators of compromise
Key facts for TL-2026-1068
- Threat ID
- TL-2026-1068
- Severity
- HIGH
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, critical infrastructure, enterprise, technology, health, finance
- Target regions
- Global, North America
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in CVE-2026-45659
Malware and tooling: LockBit 3.0 - S1202, Warlock ransomware, PSEXEC, masscan
How CVE-2026-45659 works
CVE-2026-45659 is a CVSS 8.8 deserialization-of-untrusted-data remote code execution vulnerability in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-01 after confirming active in-the-wild exploitation and ordered federal agencies to patch by 2026-07-04/05. Over 10,000 internet-facing SharePoint servers remain exposed per Shadowserver, with unknown patch adoption.
CVE-2026-45659 is a deserialization-of-untrusted-data vulnerability (CWE-502) in Microsoft Office SharePoint that allows an authenticated attacker holding only minimum Site Member permissions to execute arbitrary code remotely over the network, with no user interaction required. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): network attack vector, low attack complexity, low privileges required, no user interaction, and high impact to confidentiality, integrity, and availability. Microsoft patched the vulnerability on 2026-05-21 (initially omitted from the scheduled May 2026 Patch Tuesday release and shipped as an out-of-band/emergency addition) for SharePoint Server Subscription Edition (build 16.0.19725.20280, KB5002863), SharePoint Server 2019 (build 16.0.10417.20128, KB5002870), and SharePoint Enterprise Server 2016 (build 16.0.5552.1002, KB5002868). At disclosure, Microsoft assessed the flaw as 'Exploitation Less Likely' and no public exploitation was known. That assessment proved incorrect: CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-07-01 after observing evidence of active exploitation in the wild, invoking Binding Operational Directive 26-04 and ordering Federal Civilian Executive Branch (FCEB) agencies to remediate by 2026-07-04/05 (a 3-day window reflecting active-exploitation urgency). As of KEV addition, the specific exploitation vector in the wild, the identity of the threat actor(s), and campaign objectives (espionage vs. financially motivated ransomware/extortion) were not publicly confirmed by CISA or Microsoft. Shadowserver Foundation honeypot/internet-scan telemetry identified more than 10,000 internet-facing SharePoint servers still reachable online with unknown patch status, representing a large exposed attack surface. The vulnerability chain fits a well-established pattern for on-premises SharePoint: an authenticated, low-privileged user submits a specially crafted serialized object to a vulnerable SharePoint endpoint/web service; SharePoint's server-side deserialization logic instantiates the object without adequate type/origin validation, triggering a gadget chain that results in arbitrary .NET code execution in the context of the SharePoint application pool (typically NT AUTHORITY\SYSTEM or a highly privileged service account on IIS). Successful exploitation grants a foothold suitable for webshell deployment, credential/token theft (including machine keys used to forge ViewState payloads, a technique repeatedly abused in prior SharePoint RCE chains), lateral movement across the SharePoint farm and connected Active Directory environment, and downstream ransomware or espionage objectives. This disclosure lands roughly one year after Microsoft on-premises SharePoint suffered the widely exploited 'ToolShell' vulnerability chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) which the China-nexus, dual-purpose (espionage + ransomware) actor Storm-2603 weaponized at scale in July 2025 to deploy Warlock and LockBit Black ransomware and a custom DNS-tunneling backdoor across government and critical-infrastructure targets, including a US nuclear weapons agency facility. CVE-2026-45659 was also patched roughly one month after another actively exploited SharePoint flaw, the spoofing/reflected-XSS vulnerability CVE-2026-32201 (CVSS 6.5, CWE-20 improper input validation), which was itself observed under active exploitation against 1,300+ internet-exposed SharePoint servers to steal session cookies and NTLM tokens via crafted page parameters, ahead of its April 2026 patch. This repeated pattern of chained, actively-exploited on-premises SharePoint vulnerabilities makes CVE-2026-45659 a high-priority patch/hunt target: on-prem SharePoint has become a recurring beachhead for nation-state-linked ransomware crews targeting government, critical infrastructure, and enterprise environments worldwide, and organizations running exposed on-prem SharePoint farms should treat the KEV addition as strong evidence that a working exploit or exploit chain is circulating.
MITRE ATT&CK techniques used in TL-2026-1068
Collection
Lateral Movement
T1021 Remote Services; T1550.002 Pass the Hash
Discovery
T1046 Network Service Discovery; T1082 System Information Discovery
Execution
T1059 Command and Scripting Interpreter; T1059.001 PowerShell; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Defense Evasion
T1070 Indicator Removal; T1218 System Binary Proxy Execution
Command and Control
T1071.004 DNS; T1105 Ingress Tool Transfer
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Impact
T1486 Data Encrypted for Impact
Persistence
T1505.003 Web Shell; T1543 Create or Modify System Process
Credential Access
T1539 Steal Web Session Cookie; T1552.004 Private Keys; T1606 Forge Web Credentials
Reconnaissance
T1595.002 Vulnerability Scanning
defense-impairment
Affected products and versions in CVE-2026-45659
- Microsoft — SharePoint Enterprise Server 2016
Vulnerable versions: 16.0 pre-2026-05-21 builds
Fixed in: 16.0.5552.1002 (KB5002868) - Microsoft — SharePoint Server 2019
Vulnerable versions: 16.0 pre-2026-05-21 builds
Fixed in: 16.0.10417.20128 (KB5002870) - Microsoft — SharePoint Server Subscription Edition
Vulnerable versions: 16.0 pre-2026-05-21 builds
Fixed in: 16.0.19725.20280 (KB5002863)
Remediation for CVE-2026-45659
Patches
- KB5002863 - SharePoint Server Subscription Edition (build 16.0.19725.20280)
- KB5002870 - SharePoint Server 2019 (build 16.0.10417.20128)
- KB5002868 - SharePoint Enterprise Server 2016 (build 16.0.5552.1002)
Immediate actions
- Apply Microsoft's May 21, 2026 out-of-band security update for CVE-2026-45659 (KB5002863 for Subscription Edition, KB5002870 for Server 2019, KB5002868 for Enterprise Server 2016) on all on-premises SharePoint farm servers
- Federal agencies: comply with CISA BOD 26-04 KEV remediation deadline of 2026-07-04/05
- Audit internet-facing SharePoint servers and restrict direct internet exposure via VPN, reverse proxy, or Zero Trust access broker until patched
- Rotate SharePoint machine keys (ASP.NET machineKey / SharePoint farm keys) post-patch to invalidate any forged ViewState or authentication artifacts obtained prior to patching
- Review IIS, ULS, and SharePoint audit logs for anomalous authenticated requests to deserialization-capable endpoints, unexpected w3wp.exe child processes, and webshell drops in SharePoint web application directories
Workarounds
- Where patching cannot be immediate, disable or restrict access to the affected SharePoint web services/endpoints for non-administrative users
- Restrict Site Member-level provisioning and review existing Site Member accounts for anomalous or unnecessary grants
- Front internet-facing SharePoint with a WAF configured to inspect and block anomalous serialized-object payloads in request bodies
Longer-term hardening
- Deploy EDR with behavioral detection on all SharePoint front-end and application servers to catch post-exploitation process trees
- Enforce least-privilege on SharePoint Site Member/Contributor roles; monitor and alert on privilege changes
- Implement network segmentation isolating SharePoint farms from broader Active Directory and crown-jewel systems
- Establish a recurring patch-Tuesday-plus-out-of-band monitoring process specifically for Microsoft SharePoint given its recurring history of actively exploited on-prem RCE/deserialization flaws
CVEs associated with CVE-2026-45659
Weaknesses (CWE) in CVE-2026-45659
Timeline of CVE-2026-45659
- Microsoft patches related actively-exploited SharePoint spoofing/XSS flaw CVE-2026-32201 (CWE-20) via KB5002659/KB5002658, after exploitation against 1,300+ internet-exposed servers to steal session cookies and NTLM tokens.
- Microsoft releases the out-of-band security update for CVE-2026-45659 (KB5002863, KB5002868, KB5002870) after the fix was omitted from the scheduled May 2026 Patch Tuesday cycle.
- Security media (Help Net Security) reports on CVE-2026-45659, noting CVSS 8.8 and Microsoft's initial 'Exploitation Less Likely' assessment.
- The Hacker News and Security Affairs publish detailed technical writeups on CVE-2026-45659, covering affected SharePoint versions and patch build numbers.
- Apolo Cybersecurity publishes combined analysis of CVE-2026-32201 and CVE-2026-45659 describing SharePoint under 'double active threat.'
- BleepingComputer and The Hacker News report on the CISA KEV addition, noting Shadowserver's tracking of 10,000+ exposed SharePoint servers with unknown patch status.
- CISA adds CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) catalog citing evidence of active in-the-wild exploitation, invoking Binding Operational Directive 26-04.
- CISA-mandated deadline for Federal Civilian Executive Branch agencies to remediate CVE-2026-45659 under BOD 26-04.
Sources cited for CVE-2026-45659
- CISA: Microsoft SharePoint RCE flaw now actively exploited
- SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
- Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions
- High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659)
- SharePoint Under Double Active Threat: CVE-2026-32201 Zero-Day Still Exploited While Microsoft Releases New RCE (CVE-2026-45659)
- NVD - CVE-2026-45659 Detail
- Microsoft Security Response Center - CVE-2026-45659 Update Guide
- CISA Known Exploited Vulnerabilities Catalog - CVE-2026-45659
- Microsoft SharePoint Has a New RCE Flaw. If You Haven't Patched Yet, Go Do That.
- Before ToolShell: Exploring Storm-2603's Previous Ransomware Operations
- Storm-2603 Deploys DNS-Controlled Backdoor in Warlock and LockBit Ransomware Attacks
- Storm-2603: Targeting SharePoint Vulnerabilities and Critical Infrastructure Worldwide
Detection coverage for TL-2026-1068
As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1068 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.