Digitalspying Inc.

Perimeter Risk: CISA Adds Microsoft SharePoint Server RCE Flaw (CVE-2026-45659) to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added a high-severity remote code execution (RCE) vulnerability found in Microsoft SharePoint Server, tracked as CVE-2026-45659, to its Known Exploited Vulnerabilities (KEV) catalog. Initially resolved by Microsoft during the late May 2026 patch cycle, the flaw has now transitioned from a theoretical risk to active, real-world exploitation by sophisticated threat actors. Assigned a CVSS severity score of 8.8 (High), this deserialization vulnerability enables authenticated local users possessing minimal privileges—such as standard "Site Member" access—to remotely execute arbitrary code across vulnerable on-premises SharePoint network deployments. Enterprises must immediately apply security updates to defend against active exploitation campaigns targeting corporate infrastructure.

Technical Deep-Dive into CVE-2026-45659

Microsoft SharePoint Server functions as a highly deployed document management and collaboration platform, utilized extensively across enterprise networks and government intranets for centralized data storage. The vulnerability, designated as CVE-2026-45659, is a high-severity deserialization flaw categorized structurally under CWE-502: Deserialization of Untrusted Data.

Attack Vector and Exploitation Mechanics

The exploitation sequence for this SharePoint vulnerability relies on several critical failure points in data handling:

1. Unsafe Deserialization Process: The fundamental flaw resides within SharePoint Server's internal handling of serialized data objects during routine collaboration workflows. When the server processes serialized input transmitted across trust boundaries, it executes this action without sufficient cryptographic type-validation.
2. Low-Privilege Exploitation Requirements: An attacker requires only basic network access and minimal authentication—specifically, standard "Site Member" permissions (Privileges Required: Low)—to submit a custom-crafted serialized payload directly to a vulnerable SharePoint instance.
3. Arbitrary Code Execution: Upon receiving the payload, the SharePoint server deserializes the malicious input, which inadvertently forces the underlying application to instantiate arbitrary objects, successfully achieving remote code execution.
4. Security Context and Privilege Escalation: Because the exploit fundamentally executes within the context of the primary SharePoint service account, successful exploitation can allow a malicious actor to completely bypass standard data isolation boundaries and potentially escalate privileges.

Affected SharePoint Server Versions

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server 2016
• Microsoft SharePoint Enterprise Server 2016

Industry Impact and Enterprise Threat Landscape

SharePoint servers frequently serve as the central repositories for highly confidential corporate databases, proprietary documents, and strategic internal communication. Consequently, a remote code execution vulnerability on these centralized servers represents a critical enterprise threat.

Because the vulnerability requires only low-level, authenticated member credentials—which can be easily obtained by threat actors via targeted phishing campaigns, session hijacking, or credential reuse attacks—any internet-facing or broadly accessible SharePoint server remains at extreme risk. A successful network compromise allows attackers to execute numerous malicious actions:

• Access, exfiltrate, download, or permanently delete confidential corporate files and intellectual property.
• Extract sensitive corporate credentials, authentication tokens, and session materials.
• Establish deep administrative persistence on the local server infrastructure for long-term espionage.
• Move laterally across the wider enterprise network to systematically compromise connected active directories and backend database environments.

CISA's urgent addition of CVE-2026-45659 to its KEV catalog serves as definitive confirmation that advanced persistent threat (APT) groups and ransomware operators are actively exploiting this specific vector to bypass perimeter controls in ongoing real-world attacks.

Strategic Recommendations and Remediation Mitigations

Organizations actively operating on-premises SharePoint Server builds must urgently implement the following comprehensive security mitigations:

1. Deploy Security Updates Immediately: Administrators must rapidly install the official out-of-band Microsoft patches corresponding to their specific SharePoint Server build (Subscription Edition, 2019, or 2016) to close the deserialization vulnerability.
2. Restrict Internal and External Network Exposure: Security teams must avoid exposing on-premises SharePoint portal interfaces directly to the public internet. Secure all administrative and user access strictly behind a robust Virtual Private Network (VPN) architecture or a Zero Trust Network Access (ZTNA) gateway.
3. Audit Active Account Privileges and Group Memberships: Continuously review group memberships across all hosted SharePoint sites. Keep the "Site Member" list tightly restricted to necessary personnel, and aggressively audit active directories for any unusual or anomalous authenticated actions originating on SharePoint servers.
4. Implement Endpoint File and Process Monitoring: Deploy advanced endpoint detection and response (EDR) solutions to proactively monitor SharePoint web services and core processes (such as w3wp.exe) for anomalous child process execution events, including unauthorized calls to command-line interfaces like cmd.exe or powershell.exe.

Frequently Asked Questions (FAQ)

Below are common questions regarding the Microsoft SharePoint Server RCE vulnerability and the CISA KEV catalog update.

What is CVE-2026-45659?

CVE-2026-45659 is a high-severity Remote Code Execution (RCE) vulnerability affecting multiple versions of Microsoft SharePoint Server. It is caused by the unsafe deserialization of untrusted data, allowing authenticated attackers to execute malicious code on the server.

Who is affected by this SharePoint vulnerability?

Organizations utilizing on-premises deployments of Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 are directly affected. Cloud-based SharePoint Online instances are not impacted by this specific deserialization flaw.

How can organizations protect against CVE-2026-45659?

The most effective mitigation is to immediately apply the official Microsoft security patches released in May 2026. Additionally, organizations should restrict SharePoint network exposure, audit user privileges, and monitor server processes for suspicious activity.