Threat reportVulnerabilityTL-2026-1074
CVE-2026-45659: Microsoft SharePoint Deserialization RCE Added to CISA KEV Despite 'Exploitation Less Likely' Rating
CVE-2026-45659 (TL-2026-1074) is a high-severity software vulnerability scored CVSS 8.8, first published 2026-07-02. It has no confirmed attribution, affects Microsoft SharePoint Server Subscription Edition, references 1 CVE (CVE-2026-45659), maps to 20 MITRE ATT&CK techniques (T1005, T1053, T1059), and is covered by 9 detection rules and 20 indicators of compromise.
- CVSS
- 8.8/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 20MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-1074
- Threat ID
- TL-2026-1074
- Severity
- HIGH
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, education, energy, telecoms, technology, finance
- Target regions
- North America, Europe, Asia
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in CVE-2026-45659
Malware and tooling: LockBit 3.0 - S1202, WarLock, Project AK47
How CVE-2026-45659 works
CISA added CVE-2026-45659, a CVSS 8.8 SharePoint Server remote code execution flaw caused by insecure deserialization of untrusted data, to its Known Exploited Vulnerabilities catalog on 2026-07-01 after confirming active exploitation. Microsoft rated the flaw 'Exploitation Less Likely' when it patched it in May 2026, but any authenticated attacker holding only Site Member permissions can trigger remote code execution without admin rights. FCEB agencies must remediate by 2026-07-04.
CVE-2026-45659 is a remote code execution vulnerability in on-premises Microsoft SharePoint Server arising from deserialization of untrusted data (CWE-502). The vulnerable code path lives in SharePoint's list item handling: attacker-controlled data passed through the Update() method of list items is deserialized when custom field types using ViewState-like serialization are processed. The vulnerable code calls LosFormatter.Deserialize on this data with no proper type filtering or ObjectStateFormatter restrictions, allowing an attacker to smuggle a malicious serialized .NET object graph that executes arbitrary code in the context of the SharePoint service account upon deserialization.
Exploitation requires only a low-privilege, authenticated session — a user holding Site Member permissions with Contribute rights on at least one editable list is sufficient; no administrative privileges, no user interaction, and no special environmental conditions are needed. The attack is delivered over the network via REST or CSOM calls to list-item update endpoints (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 8.8).
Microsoft shipped fixes in its May 2026 Patch Tuesday release for SharePoint Server Subscription Edition (KB5002863, fixed build 16.0.19725.20280), SharePoint Server 2019 (KB5002870, fixed build 16.0.10417.20128), and SharePoint Enterprise Server 2016 (KB5002868, fixed build 16.0.5552.1002). SharePoint Online / Microsoft 365 is not affected, limiting exposure to on-premises deployments. At patch time Microsoft's Exploitability Assessment rated the bug 'Exploitation Less Likely.' That assessment proved incorrect: on 2026-07-01 CISA added CVE-2026-45659 to the Known Exploited Vulnerabilities (KEV) catalog citing confirmed evidence of active in-the-wild exploitation, and under Binding Operational Directive 22-01/26-04 gave FCEB agencies until 2026-07-04 to remediate.
A public proof-of-concept exploit (cve-2026-45659.py) circulates on GitHub, accepting a target URL, low-privilege credentials, a target site/list, and a command to execute, and triggering the deserialization through REST/CSOM list-item update calls. The researcher credited with discovery/reporting is tracked publicly as 'MEOW.' No confirmed threat-actor attribution or malware family has been publicly tied to the July 2026 active-exploitation activity as of this writing; however, on-premises SharePoint deserialization/RCE bugs have been an established attack surface for the China-nexus actor Storm-2603 (aka Warlock Group / GOLD SALEM), which since March 2025 has repeatedly weaponized SharePoint RCE chains (the 'ToolShell' vulnerabilities CVE-2025-49704/CVE-2025-49706/CVE-2025-53770/CVE-2025-53771) to drop ASPX web shells (spinstall0.aspx), abuse BYOVD to blind EDR, and deploy Warlock/LockBit Black ransomware and the Project AK47 toolset across 400+ victims in government, education, energy, and telecom sectors. Defenders should treat this CVE with the same operational playbook used for prior SharePoint deserialization/RCE incidents given the near-identical exploitation profile (authenticated, low-privilege, network RCE against on-prem SharePoint).
MITRE ATT&CK techniques used in TL-2026-1074
Collection
Persistence
T1053 Scheduled Task/Job; T1505 Server Software Component; T1543 Create or Modify System Process
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Discovery
T1069 Permission Groups Discovery; T1082 System Information Discovery
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
stealth
Defense Evasion
T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth
Lateral Movement
T1210 Exploitation of Remote Services
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop
execution
defense-impairment
Affected products and versions in CVE-2026-45659
- Microsoft — SharePoint Server Subscription Edition
Vulnerable versions: < 16.0.19725.20280
Fixed in: 16.0.19725.20280 (KB5002863) - Microsoft — SharePoint Server 2019
Vulnerable versions: < 16.0.10417.20128
Fixed in: 16.0.10417.20128 (KB5002870) - Microsoft — SharePoint Enterprise Server 2016
Vulnerable versions: < 16.0.5552.1002
Fixed in: 16.0.5552.1002 (KB5002868)
Remediation for CVE-2026-45659
Patches
- KB5002863 — SharePoint Server Subscription Edition
- KB5002870 — SharePoint Server 2019
- KB5002868 — SharePoint Enterprise Server 2016
Immediate actions
- Apply Microsoft's May 2026 SharePoint security updates: KB5002863 (Subscription Edition), KB5002870 (2019), KB5002868 (2016)
- Verify SharePoint build numbers meet or exceed the fixed builds: 16.0.19725.20280 (Subscription Edition), 16.0.10417.20128 (2019), 16.0.5552.1002 (2016)
- FCEB agencies must remediate per CISA KEV by 2026-07-04
- Audit SharePoint site membership and list Contribute permissions for unnecessary low-privilege accounts
- Hunt for anomalous list-item Update() calls via REST/CSOM endpoints and unexpected w3wp.exe child-process spawning on SharePoint front-end servers
Workarounds
- No workaround beyond patching is documented; restrict authenticated access to SharePoint list-update endpoints where patching is delayed
Longer-term hardening
- Deploy EDR/behavioral monitoring on SharePoint servers focused on IIS worker process anomalies and unexpected .NET assembly loads
- Enforce least-privilege site membership; restrict Contribute rights on lists to only what's operationally required
- Network-segment on-prem SharePoint farms from sensitive internal assets to limit lateral movement post-RCE
- Establish a SharePoint patch-validation cadence given the platform's recurring history as an RCE target (ToolShell family, this CVE)
CVEs associated with CVE-2026-45659
Weaknesses (CWE) in CVE-2026-45659
Timeline of CVE-2026-45659
- Storm-2603/GOLD SALEM begins mass-exploiting the related on-premises SharePoint deserialization/RCE chain (CVE-2025-49704/49706/53770/53771, dubbed 'ToolShell'), establishing the precedent attack profile CVE-2026-45659 would later fit
- The Hacker News reports Storm-2603 deploying a DNS-controlled backdoor alongside Warlock and LockBit Black ransomware in SharePoint ToolShell intrusions
- Unit 42 publishes 'Project AK47,' linking a backdoor/loader/ransomware toolset to the SharePoint-exploiting Storm-2603 intrusion set
- Check Point Research publishes 'Before ToolShell,' detailing Storm-2603's prior ransomware operations ahead of its SharePoint RCE campaigns
- Microsoft's May 2026 Patch Tuesday ships fixes for CVE-2026-45659 across SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016
- CVE-2026-45659 formally published with CVSS 3.1 base score 8.8 and CWE-502 (Deserialization of Untrusted Data) classification
- Vulert publishes technical breakdown of CVE-2026-45659's SharePoint list-item deserialization root cause
- Security media (Help Net Security, SharkStriker, IT-Connect) publish technical coverage; Microsoft's exploitability assessment rated 'Exploitation Less Likely'
- SecurityAffairs urges immediate patching of the new SharePoint RCE flaw, reiterating the fixed-build guidance
- The Hacker News reports CVE-2026-45659's addition to the CISA KEV catalog following confirmed active exploitation
- SOCRadar publishes analysis flagging the KEV addition and its implications for unpatched on-prem SharePoint farms
- CISA adds CVE-2026-45659 to the Known Exploited Vulnerabilities catalog, citing confirmed evidence of active in-the-wild exploitation
- The Register and The Hacker News report on the discrepancy between Microsoft's 'Exploitation Less Likely' rating and CISA's confirmed active-exploitation KEV addition
- Public proof-of-concept exploit (cve-2026-45659.py) for the SharePoint deserialization RCE observed on GitHub
- CISA-mandated remediation deadline for U.S. Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04
Sources cited for CVE-2026-45659
- Microsoft said exploitation was 'less likely' ... but CISA just added SharePoint RCE to KEV list
- SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
- Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions
- CISA Flags SharePoint RCE (CVE-2026-45659) for Active Exploitation
- High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659)
- CVE-2026-45659-SharePoint-RCE PoC
- CVE-2026-45659 Detail - NVD
- Known Exploited Vulnerabilities Catalog
- CVE-2026-45659 Microsoft SharePoint RCE Flaw Patched Across Server Versions
- CVE-2026-45659: Microsoft fixes a major SharePoint RCE flaw
- Storm-2603 Deploys DNS-Controlled Backdoor in Warlock and LockBit Ransomware Attacks
- Before ToolShell: Exploring Storm-2603's Previous Ransomware Operations
- Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
- Microsoft SharePoint Has a New RCE Flaw. If You Haven't Patched Yet, Go Do That.
- Microsoft Patches SharePoint RCE Flaw CVE-2026-45659
Detection coverage for TL-2026-1074
As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1074 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.