# CISA KEV Addition: Microsoft SharePoint Server Deserialization RCE (CVE-2026-45659) Actively Exploited by Storm-2603 / Warlock Ransomware

> CISA added CVE-2026-45659, a CWE-502 deserialization-of-untrusted-data RCE in on-premises Microsoft SharePoint Server, to its KEV catalog on 2026-07-01 citing active exploitation, with FCEB remediation due 2026-07-04 under BOD 26-04. An authenticated attacker holding only Site Member permissions can achieve unauthenticated-equivalent remote code execution; exploitation activity has been linked to Storm-2603 (aka Warlock Group / GOLD SALEM), the China-nexus, financially-motivated actor previously behind the 2025 SharePoint 'ToolShell' Warlock/LockBit Black ransomware campaigns.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1123
- **ID:** TL-2026-1123
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Storm-2603 (China)
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-45659

## Description

CVE-2026-45659 is a remote code execution vulnerability (CVSS 3.1: 8.8) in Microsoft SharePoint Server caused by deserialization of untrusted data (CWE-502). The flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. An authenticated attacker with only Site Member-level permissions (no elevated privileges, no user interaction) can submit a crafted serialized object to a SharePoint endpoint and trigger deserialization of attacker-controlled data, resulting in arbitrary code execution in the context of the SharePoint application pool (w3wp.exe).

Microsoft shipped the fix as an out-of-band security update on 2026-05-21 (build updates for all three product lines), but the CVE was inadvertently omitted from the official May 2026 Patch Tuesday release notes; Microsoft corrected the advisory on 2026-05-27. This omission meant organizations that reviewed the May release notes and saw no SharePoint entry may have deprioritized deployment of a patch they had, in fact, already received — a gap that active exploitation subsequently moved through. CVE-2026-45659 is part of a related deserialization vulnerability pair disclosed in the same update cycle alongside CVE-2026-47294 (CVSS 8.0, CWE-78 OS command injection via deserialization, requiring Site Owner privileges); no active exploitation of CVE-2026-47294 has been confirmed as of this writing.

CISA added CVE-2026-45659 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-01, confirming in-the-wild exploitation and setting a BOD 26-04 remediation deadline of 2026-07-04 for FCEB agencies. Public exploit code purporting to target this CVE has since appeared on GitHub (mistbarbarianspot/CVE-2026-45659-SharePoint-RCE), increasing the population of capable attackers.

Post-exploitation activity observed in the wild mirrors the 2025 'ToolShell' SharePoint campaign (CVE-2025-49704/49706/53770/53771) run by Storm-2603 (aka Warlock Group / GOLD SALEM), a suspected China-based, financially motivated actor with a hybrid espionage/ransomware operating model. Attackers drop the spinstall0.aspx web shell to exfiltrate the SharePoint farm's ASP.NET machine keys (ValidationKey, DecryptionKey, CompatibilityMode), which are then used to forge valid ViewState payloads and re-authenticate as the server indefinitely, surviving simple patch application unless keys are rotated. From this foothold, actors have deployed the AK47C2 backdoor framework (dnsclient/httpclient modules communicating over DNS-TXT tunneling and HTTP POST with XOR-obfuscated JSON, key 'VHBD@H'), harvested credentials from LSASS via Mimikatz, moved laterally with PsExec/Impacket/WMI, disabled endpoint defenses via BYOVD (signed vulnerable driver abused with IOCTL 0x99000050) and DLL search-order hijacking (7z.exe/7z.dll, clink_x86.exe/clink_dll_x86.dll, spoofed Mpclient.dll beside MpCmdRun.exe), and ultimately deployed Warlock (aka X2anylock) and/or LockBit Black ransomware, in several cases pushed farm-wide via Group Policy modification. Microsoft investigators also identified a second, unrelated threat actor co-existing in at least one compromised environment, using distinct DLL side-loading tradecraft and custom backdoors, who subsequently pivoted into a second victim organization.

Victim sectors span government, healthcare, financial services, education, and critical infrastructure. Given the low bar for exploitation (any authenticated low-privilege user), the patch-notes omission that likely left many farms unpatched, and confirmed ransomware-capable actor involvement, this represents a critical, actively-exploited threat to any internet-facing or internally-exposed on-premises SharePoint deployment.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1569 System Services
- T1047 Windows Management Instrumentation
- T1505 Server Software Component
- T1053 Scheduled Task/Job
- T1574 Hijack Execution Flow
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1484 Domain or Tenant Policy Modification
- T1027 Obfuscated Files or Information
- T1003 OS Credential Dumping
- T1606 Forge Web Credentials
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1071 Application Layer Protocol
- T1572 Protocol Tunneling
- T1219 Remote Access Tools
- T1486 Data Encrypted for Impact

## Sources

- [CISA Adds One Known Exploited Vulnerability to Catalog](https://www.cisa.gov/news-events/alerts/2026/07/01/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CISA Known Exploited Vulnerabilities Catalog (feed entry: CVE-2026-45659)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [CVE-2026-45659 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-45659)
- [Security Update Guide - CVE-2026-45659](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659)
- [Security Update Guide - CVE-2026-47294](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47294)
- [SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation](https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html)
- [Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions](https://thehackernews.com/2026/05/microsoft-patches-sharepoint-rce-flaw.html)
- [CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability](https://www.securityweek.com/cisa-warns-of-actively-exploited-microsoft-sharepoint-vulnerability/)
- [High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659)](https://www.helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659/)
- [CISA Flags SharePoint RCE (CVE-2026-45659) for Active Exploitation](https://socradar.io/blog/cisa-sharepoint-rce-cve-2026-45659/)
- [Active Exploitation Alert: Critical Microsoft SharePoint Server RCE Vulnerability CVE-2026-45659 Added to CISA KEV Catalog](https://www.rescana.com/post/active-exploitation-alert-critical-microsoft-sharepoint-server-rce-vulnerability-cve-2026-45659-added-to-cisa-kev-catalo)
- [CVE-2026-45659: Microsoft SharePoint Server Deserialization Remote Code Execution (CISA KEV)](https://threat-modeling.com/cve-2026-45659-microsoft-sharepoint-deserialization-rce-cisa-kev/)
- [Microsoft SharePoint Deserialization Vulnerabilities (CVE-2026-47294, CVE-2026-45659): Authenticated Remote Code Execution](https://threat-modeling.com/sharepoint-deserialization-rce-cve-2026-47294-45659/)
- [Microsoft SharePoint: CVE-2026-45659](https://www.rapid7.com/db/vulnerabilities/microsoft-sharepoint-cve-2026-45659/)
- [CVE-2026-45659-SharePoint-RCE (public PoC)](https://github.com/mistbarbarianspot/CVE-2026-45659-SharePoint-RCE)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1123