# CVE-2026-45659: Microsoft SharePoint Deserialization RCE Actively Exploited, Added to CISA KEV

> CVE-2026-45659 is a CVSS 8.8 deserialization-of-untrusted-data remote code execution vulnerability in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-01 after confirming active in-the-wild exploitation and ordered federal agencies to patch by 2026-07-04/05. Over 10,000 internet-facing SharePoint servers remain exposed per Shadowserver, with unknown patch adoption.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1068
- **ID:** TL-2026-1068
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-45659, CVE-2026-32201

## Description

CVE-2026-45659 is a deserialization-of-untrusted-data vulnerability (CWE-502) in Microsoft Office SharePoint that allows an authenticated attacker holding only minimum Site Member permissions to execute arbitrary code remotely over the network, with no user interaction required. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): network attack vector, low attack complexity, low privileges required, no user interaction, and high impact to confidentiality, integrity, and availability. Microsoft patched the vulnerability on 2026-05-21 (initially omitted from the scheduled May 2026 Patch Tuesday release and shipped as an out-of-band/emergency addition) for SharePoint Server Subscription Edition (build 16.0.19725.20280, KB5002863), SharePoint Server 2019 (build 16.0.10417.20128, KB5002870), and SharePoint Enterprise Server 2016 (build 16.0.5552.1002, KB5002868). At disclosure, Microsoft assessed the flaw as 'Exploitation Less Likely' and no public exploitation was known. That assessment proved incorrect: CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-07-01 after observing evidence of active exploitation in the wild, invoking Binding Operational Directive 26-04 and ordering Federal Civilian Executive Branch (FCEB) agencies to remediate by 2026-07-04/05 (a 3-day window reflecting active-exploitation urgency). As of KEV addition, the specific exploitation vector in the wild, the identity of the threat actor(s), and campaign objectives (espionage vs. financially motivated ransomware/extortion) were not publicly confirmed by CISA or Microsoft. Shadowserver Foundation honeypot/internet-scan telemetry identified more than 10,000 internet-facing SharePoint servers still reachable online with unknown patch status, representing a large exposed attack surface. The vulnerability chain fits a well-established pattern for on-premises SharePoint: an authenticated, low-privileged user submits a specially crafted serialized object to a vulnerable SharePoint endpoint/web service; SharePoint's server-side deserialization logic instantiates the object without adequate type/origin validation, triggering a gadget chain that results in arbitrary .NET code execution in the context of the SharePoint application pool (typically NT AUTHORITY\SYSTEM or a highly privileged service account on IIS). Successful exploitation grants a foothold suitable for webshell deployment, credential/token theft (including machine keys used to forge ViewState payloads, a technique repeatedly abused in prior SharePoint RCE chains), lateral movement across the SharePoint farm and connected Active Directory environment, and downstream ransomware or espionage objectives. This disclosure lands roughly one year after Microsoft on-premises SharePoint suffered the widely exploited 'ToolShell' vulnerability chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) which the China-nexus, dual-purpose (espionage + ransomware) actor Storm-2603 weaponized at scale in July 2025 to deploy Warlock and LockBit Black ransomware and a custom DNS-tunneling backdoor across government and critical-infrastructure targets, including a US nuclear weapons agency facility. CVE-2026-45659 was also patched roughly one month after another actively exploited SharePoint flaw, the spoofing/reflected-XSS vulnerability CVE-2026-32201 (CVSS 6.5, CWE-20 improper input validation), which was itself observed under active exploitation against 1,300+ internet-exposed SharePoint servers to steal session cookies and NTLM tokens via crafted page parameters, ahead of its April 2026 patch. This repeated pattern of chained, actively-exploited on-premises SharePoint vulnerabilities makes CVE-2026-45659 a high-priority patch/hunt target: on-prem SharePoint has become a recurring beachhead for nation-state-linked ransomware crews targeting government, critical infrastructure, and enterprise environments worldwide, and organizations running exposed on-prem SharePoint farms should treat the KEV addition as strong evidence that a working exploit or exploit chain is circulating.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1505.003 Web Shell
- T1543 Create or Modify System Process
- T1068 Exploitation for Privilege Escalation
- T1218 System Binary Proxy Execution
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1539 Steal Web Session Cookie
- T1606 Forge Web Credentials
- T1552.004 Private Keys
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1021 Remote Services
- T1550.002 Pass the Hash
- T1005 Data from Local System
- T1071.004 DNS
- T1105 Ingress Tool Transfer
- T1486 Data Encrypted for Impact
- T1595.002 Vulnerability Scanning

## Sources

- [CISA: Microsoft SharePoint RCE flaw now actively exploited](https://www.bleepingcomputer.com/news/security/cisa-microsoft-sharepoint-rce-flaw-now-actively-exploited/)
- [SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation](https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html)
- [Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions](https://thehackernews.com/2026/05/microsoft-patches-sharepoint-rce-flaw.html)
- [High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659)](https://www.helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659/)
- [SharePoint Under Double Active Threat: CVE-2026-32201 Zero-Day Still Exploited While Microsoft Releases New RCE (CVE-2026-45659)](https://www.apolocybersecurity.com/en/blog-posts/sharepoint-double-threat-cve-2026-32201-zero-day-cve-2026-45659-rce)
- [NVD - CVE-2026-45659 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-45659)
- [Microsoft Security Response Center - CVE-2026-45659 Update Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-45659](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45659)
- [Microsoft SharePoint Has a New RCE Flaw. If You Haven't Patched Yet, Go Do That.](https://securityaffairs.com/192730/security/microsoft-sharepoint-has-a-new-rce-flaw-if-you-havent-patched-yet-go-do-that.html)
- [Before ToolShell: Exploring Storm-2603's Previous Ransomware Operations](https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/)
- [Storm-2603 Deploys DNS-Controlled Backdoor in Warlock and LockBit Ransomware Attacks](https://thehackernews.com/2025/08/storm-2603-exploits-sharepoint-flaws-to.html)
- [Storm-2603: Targeting SharePoint Vulnerabilities and Critical Infrastructure Worldwide](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/storm-2603-targeting-sharepoint-vulnerabilities-and-critical-infrastructure-worldwide/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1068