# CVE-2026-45659: Microsoft SharePoint Deserialization RCE Added to CISA KEV Despite 'Exploitation Less Likely' Rating

> CISA added CVE-2026-45659, a CVSS 8.8 SharePoint Server remote code execution flaw caused by insecure deserialization of untrusted data, to its Known Exploited Vulnerabilities catalog on 2026-07-01 after confirming active exploitation. Microsoft rated the flaw 'Exploitation Less Likely' when it patched it in May 2026, but any authenticated attacker holding only Site Member permissions can trigger remote code execution without admin rights. FCEB agencies must remediate by 2026-07-04.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1074
- **ID:** TL-2026-1074
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-45659

## Description

CVE-2026-45659 is a remote code execution vulnerability in on-premises Microsoft SharePoint Server arising from deserialization of untrusted data (CWE-502). The vulnerable code path lives in SharePoint's list item handling: attacker-controlled data passed through the Update() method of list items is deserialized when custom field types using ViewState-like serialization are processed. The vulnerable code calls LosFormatter.Deserialize on this data with no proper type filtering or ObjectStateFormatter restrictions, allowing an attacker to smuggle a malicious serialized .NET object graph that executes arbitrary code in the context of the SharePoint service account upon deserialization.

Exploitation requires only a low-privilege, authenticated session — a user holding Site Member permissions with Contribute rights on at least one editable list is sufficient; no administrative privileges, no user interaction, and no special environmental conditions are needed. The attack is delivered over the network via REST or CSOM calls to list-item update endpoints (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 8.8).

Microsoft shipped fixes in its May 2026 Patch Tuesday release for SharePoint Server Subscription Edition (KB5002863, fixed build 16.0.19725.20280), SharePoint Server 2019 (KB5002870, fixed build 16.0.10417.20128), and SharePoint Enterprise Server 2016 (KB5002868, fixed build 16.0.5552.1002). SharePoint Online / Microsoft 365 is not affected, limiting exposure to on-premises deployments. At patch time Microsoft's Exploitability Assessment rated the bug 'Exploitation Less Likely.' That assessment proved incorrect: on 2026-07-01 CISA added CVE-2026-45659 to the Known Exploited Vulnerabilities (KEV) catalog citing confirmed evidence of active in-the-wild exploitation, and under Binding Operational Directive 22-01/26-04 gave FCEB agencies until 2026-07-04 to remediate.

A public proof-of-concept exploit (cve-2026-45659.py) circulates on GitHub, accepting a target URL, low-privilege credentials, a target site/list, and a command to execute, and triggering the deserialization through REST/CSOM list-item update calls. The researcher credited with discovery/reporting is tracked publicly as 'MEOW.' No confirmed threat-actor attribution or malware family has been publicly tied to the July 2026 active-exploitation activity as of this writing; however, on-premises SharePoint deserialization/RCE bugs have been an established attack surface for the China-nexus actor Storm-2603 (aka Warlock Group / GOLD SALEM), which since March 2025 has repeatedly weaponized SharePoint RCE chains (the 'ToolShell' vulnerabilities CVE-2025-49704/CVE-2025-49706/CVE-2025-53770/CVE-2025-53771) to drop ASPX web shells (spinstall0.aspx), abuse BYOVD to blind EDR, and deploy Warlock/LockBit Black ransomware and the Project AK47 toolset across 400+ victims in government, education, energy, and telecom sectors. Defenders should treat this CVE with the same operational playbook used for prior SharePoint deserialization/RCE incidents given the near-identical exploitation profile (authenticated, low-privilege, network RCE against on-prem SharePoint).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1543 Create or Modify System Process
- T1053 Scheduled Task/Job
- T1068 Exploitation for Privilege Escalation
- T1610 Deploy Container
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth
- T1140 Deobfuscate/Decode Files or Information
- T1078 Valid Accounts
- T1082 System Information Discovery
- T1069 Permission Groups Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1486 Data Encrypted for Impact
- T1489 Service Stop

## Sources

- [Microsoft said exploitation was 'less likely' ... but CISA just added SharePoint RCE to KEV list](https://www.theregister.com/security/2026/07/02/microsoft-said-exploitation-was-less-likely-but-cisa-just-added-sharepoint-rce-to-kev-list/5265886)
- [SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation](https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html)
- [Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions](https://thehackernews.com/2026/05/microsoft-patches-sharepoint-rce-flaw.html)
- [CISA Flags SharePoint RCE (CVE-2026-45659) for Active Exploitation](https://socradar.io/blog/cisa-sharepoint-rce-cve-2026-45659/)
- [High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659)](https://www.helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659/)
- [CVE-2026-45659-SharePoint-RCE PoC](https://github.com/mistbarbarianspot/CVE-2026-45659-SharePoint-RCE)
- [CVE-2026-45659 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-45659)
- [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CVE-2026-45659 Microsoft SharePoint RCE Flaw Patched Across Server Versions](https://vulert.com/blog/cve-2026-45659-microsoft-sharepoint-rce-flaw/)
- [CVE-2026-45659: Microsoft fixes a major SharePoint RCE flaw](https://sharkstriker.com/blog/cve-2026-45659-microsoft-patches-a-major-rce-vulnerability-in-sharepoint/)
- [Storm-2603 Deploys DNS-Controlled Backdoor in Warlock and LockBit Ransomware Attacks](https://thehackernews.com/2025/08/storm-2603-exploits-sharepoint-flaws-to.html)
- [Before ToolShell: Exploring Storm-2603's Previous Ransomware Operations](https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/)
- [Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks](https://unit42.paloaltonetworks.com/ak47-activity-linked-to-sharepoint-vulnerabilities/)
- [Microsoft SharePoint Has a New RCE Flaw. If You Haven't Patched Yet, Go Do That.](https://securityaffairs.com/192730/security/microsoft-sharepoint-has-a-new-rce-flaw-if-you-havent-patched-yet-go-do-that.html)
- [Microsoft Patches SharePoint RCE Flaw CVE-2026-45659](https://www.it-connect.tech/microsoft-patches-sharepoint-rce-flaw-cve-2026-45659/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1074