CISA KEV Addition: Microsoft SharePoint Server Deserialization RCE (CVE-2026-45659) Actively Exploited by Storm-2603 / Warlock Ransomware

CISA KEV Addition (TL-2026-1123) is a critical-severity software vulnerability scored CVSS 8.8, first published 2026-07-01. It is attributed to Storm-2603 (China) with medium confidence, affects Microsoft SharePoint Server Subscription Edition, references 1 CVE (CVE-2026-45659), maps to 21 MITRE ATT&CK techniques (T1003, T1018, T1021), and is covered by 9 detection rules and 34 indicators of compromise.

Key facts for TL-2026-1123

Threat ID
TL-2026-1123
Severity
CRITICAL
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-01
Last reviewed
2026-07-01
Attribution
Storm-2603
Attribution confidence
MEDIUM
Nation-state nexus
China
Motivation
FINANCIAL
Target sectors
government administration, health, financial services, education, critical infrastructure
Target regions
North America, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
34

Malware and tooling in CISA KEV Addition

Malware and tooling: AK47C2, Impacket - S0357, Mimikatz, SharpHostInfo, Velociraptor, masscan

CISA added CVE-2026-45659, a CWE-502 deserialization-of-untrusted-data RCE in on-premises Microsoft SharePoint Server, to its KEV catalog on 2026-07-01 citing active exploitation, with FCEB remediation due 2026-07-04 under BOD 26-04. An authenticated attacker holding only Site Member permissions can achieve unauthenticated-equivalent remote code execution; exploitation activity has been linked to Storm-2603 (aka Warlock Group / GOLD SALEM), the China-nexus, financially-motivated actor previously behind the 2025 SharePoint 'ToolShell' Warlock/LockBit Black ransomware campaigns.

How CISA KEV Addition works

CVE-2026-45659 is a remote code execution vulnerability (CVSS 3.1: 8.8) in Microsoft SharePoint Server caused by deserialization of untrusted data (CWE-502). The flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. An authenticated attacker with only Site Member-level permissions (no elevated privileges, no user interaction) can submit a crafted serialized object to a SharePoint endpoint and trigger deserialization of attacker-controlled data, resulting in arbitrary code execution in the context of the SharePoint application pool (w3wp.exe).

Microsoft shipped the fix as an out-of-band security update on 2026-05-21 (build updates for all three product lines), but the CVE was inadvertently omitted from the official May 2026 Patch Tuesday release notes; Microsoft corrected the advisory on 2026-05-27. This omission meant organizations that reviewed the May release notes and saw no SharePoint entry may have deprioritized deployment of a patch they had, in fact, already received — a gap that active exploitation subsequently moved through. CVE-2026-45659 is part of a related deserialization vulnerability pair disclosed in the same update cycle alongside CVE-2026-47294 (CVSS 8.0, CWE-78 OS command injection via deserialization, requiring Site Owner privileges); no active exploitation of CVE-2026-47294 has been confirmed as of this writing.

CISA added CVE-2026-45659 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-01, confirming in-the-wild exploitation and setting a BOD 26-04 remediation deadline of 2026-07-04 for FCEB agencies. Public exploit code purporting to target this CVE has since appeared on GitHub (mistbarbarianspot/CVE-2026-45659-SharePoint-RCE), increasing the population of capable attackers.

Post-exploitation activity observed in the wild mirrors the 2025 'ToolShell' SharePoint campaign (CVE-2025-49704/49706/53770/53771) run by Storm-2603 (aka Warlock Group / GOLD SALEM), a suspected China-based, financially motivated actor with a hybrid espionage/ransomware operating model. Attackers drop the spinstall0.aspx web shell to exfiltrate the SharePoint farm's ASP.NET machine keys (ValidationKey, DecryptionKey, CompatibilityMode), which are then used to forge valid ViewState payloads and re-authenticate as the server indefinitely, surviving simple patch application unless keys are rotated. From this foothold, actors have deployed the AK47C2 backdoor framework (dnsclient/httpclient modules communicating over DNS-TXT tunneling and HTTP POST with XOR-obfuscated JSON, key 'VHBD@H'), harvested credentials from LSASS via Mimikatz, moved laterally with PsExec/Impacket/WMI, disabled endpoint defenses via BYOVD (signed vulnerable driver abused with IOCTL 0x99000050) and DLL search-order hijacking (7z.exe/7z.dll, clink_x86.exe/clink_dll_x86.dll, spoofed Mpclient.dll beside MpCmdRun.exe), and ultimately deployed Warlock (aka X2anylock) and/or LockBit Black ransomware, in several cases pushed farm-wide via Group Policy modification. Microsoft investigators also identified a second, unrelated threat actor co-existing in at least one compromised environment, using distinct DLL side-loading tradecraft and custom backdoors, who subsequently pivoted into a second victim organization.

Victim sectors span government, healthcare, financial services, education, and critical infrastructure. Given the low bar for exploitation (any authenticated low-privilege user), the patch-notes omission that likely left many farms unpatched, and confirmed ransomware-capable actor involvement, this represents a critical, actively-exploited threat to any internet-facing or internally-exposed on-premises SharePoint deployment.

MITRE ATT&CK techniques used in TL-2026-1123

Credential Access

T1003 OS Credential Dumping; T1606 Forge Web Credentials

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery; T1082 System Information Discovery

Lateral Movement

T1021 Remote Services; T1570 Lateral Tool Transfer

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1574 Hijack Execution Flow

Execution

T1047 Windows Management Instrumentation; T1569 System Services

Persistence

T1053 Scheduled Task/Job; T1505 Server Software Component

Command and Control

T1071 Application Layer Protocol; T1219 Remote Access Tools; T1572 Protocol Tunneling

Initial Access

T1190 Exploit Public-Facing Application

defense-impairment

T1484 Domain or Tenant Policy Modification; T1685 Disable or Modify Tools

Impact

T1486 Data Encrypted for Impact

Affected products and versions in CISA KEV Addition

  • Microsoft — SharePoint Server Subscription Edition
    Vulnerable versions: < 16.0.19725.20280
    Fixed in: 16.0.19725.20280 (KB5002863)
  • Microsoft — SharePoint Server 2019
    Vulnerable versions: < 16.0.10417.20128
    Fixed in: 16.0.10417.20128 (KB5002870)
  • Microsoft — SharePoint Enterprise Server 2016
    Vulnerable versions: < 16.0.5552.1002
    Fixed in: 16.0.5552.1002 (KB5002868)

Remediation for CISA KEV Addition

Patches

  • KB5002863 — SharePoint Server Subscription Edition, build 16.0.19725.20280
  • KB5002870 — SharePoint Server 2019, build 16.0.10417.20128
  • KB5002868 — SharePoint Enterprise Server 2016, build 16.0.5552.1002

Immediate actions

  • Apply Microsoft's May 2026 out-of-band security update (KB5002863 / KB5002870 / KB5002868) to every server in the SharePoint farm immediately, including servers believed already patched during May Patch Tuesday
  • Rotate SharePoint ASP.NET machine keys (ValidationKey/DecryptionKey) farm-wide after patching — patching alone does not invalidate machine keys already stolen via a spinstall0.aspx-style web shell
  • Hunt for spinstall0.aspx and any other unauthorized .aspx/.ashx files under LAYOUTS or web-accessible SharePoint directories
  • Isolate and forensically image any SharePoint server where w3wp.exe has spawned unexpected child processes (cmd.exe, powershell.exe, csc.exe) or where outbound DNS/HTTP connections to unrecognized domains are observed

Workarounds

  • Where immediate patching is not possible, restrict and audit Site Member account provisioning and enforce MFA/conditional access for all authenticated SharePoint sessions
  • Block outbound DNS and HTTP/HTTPS traffic from SharePoint servers to non-allow-listed destinations to disrupt AK47C2-style DNS-tunneling and HTTP C2 channels
  • Disable, restrict, or closely monitor remote-access utilities (Cloudflare Tunnel, Zoho Assist, VS Code SSH port-forwarding, Velociraptor) on SharePoint hosts, as these have been abused for covert persistence

Longer-term hardening

  • Deploy EDR with AMSI integration and behavioral detection on all SharePoint front-end, application, and search servers
  • Enforce least-privilege SharePoint permission models; restrict who can self-provision or hold Site Member access on internet-facing farms
  • Segment SharePoint farms from the broader domain and alert on PsExec/WMI/Impacket-style lateral movement originating from SharePoint hosts
  • Establish continuous CISA KEV catalog monitoring with an internal 72-hour emergency-patch SLA for actively exploited vulnerabilities

CVEs associated with CISA KEV Addition

CVE-2026-45659

Weaknesses (CWE) in CISA KEV Addition

CWE-502

Timeline of CISA KEV Addition

  • Microsoft discloses active exploitation of the 2025 SharePoint 'ToolShell' vulnerabilities (CVE-2025-49704/49706/53770/53771) by Storm-2603, establishing the TTP baseline (spinstall0.aspx web shell, machine-key theft, AK47C2 backdoor, Warlock/LockBit Black ransomware) later observed against CVE-2026-45659.
  • The Hacker News reports Storm-2603 deploying a DNS-controlled AK47C2 backdoor alongside Warlock and LockBit Black ransomware in SharePoint intrusions.
  • Microsoft ships an out-of-band security update fixing CVE-2026-45659 across SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016.
  • Help Net Security and other outlets report on the newly patched high-severity SharePoint deserialization RCE.
  • Microsoft corrects its Security Update Guide after CVE-2026-45659 was inadvertently omitted from the official May 2026 Patch Tuesday release notes, creating a risk that already-patched organizations deprioritized verification.
  • The Hacker News and SecurityWeek publish coverage of the KEV addition; exploitation activity is linked to Storm-2603 (Warlock Group / GOLD SALEM) deploying Warlock/X2anylock ransomware.
  • CISA adds CVE-2026-45659 to the Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation and invoking BOD 26-04 with a remediation deadline of 2026-07-04 for FCEB agencies.
  • Investigators identify a second, unrelated threat actor co-existing in a compromised SharePoint environment using distinct DLL side-loading tradecraft and custom backdoors, which subsequently pivots into a second victim organization.
  • BOD 26-04 remediation deadline passes for FCEB agencies required to patch or mitigate CVE-2026-45659.
  • Follow-on reporting (TechTimes, SOCRadar, others) documents victims spanning government, healthcare, financial services, education, and critical infrastructure sectors, and a public PoC exploit for CVE-2026-45659 surfaces on GitHub.

Sources cited for CISA KEV Addition

Threats related to CISA KEV Addition

Detection coverage for TL-2026-1123

As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1123 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats