# Microsoft SharePoint Vulnerability Exploited in Active Attacks — CISA Orders Federal Agencies to Patch by Saturday


## The Threat


The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are actively exploiting CVE-2026-45659, a remote code execution vulnerability in Microsoft SharePoint that allows authenticated users to execute arbitrary commands on unpatched servers. The flaw stems from improper handling of deserialization of untrusted data, a classic attack surface that deserves particular attention because it requires minimal attacker sophistication and no special system knowledge to weaponize.


What makes this vulnerability particularly dangerous is its low barrier to entry. Any authenticated user with Site Member permissions—the baseline access level in most SharePoint deployments—can trigger the flaw. The attacker does not need to be an administrator, and the exploit can be executed over the network from anywhere on the internet. According to Microsoft's security guidance, the attack is repeatable and does not require user interaction or social engineering, meaning an attacker with basic credentials can launch exploitation attempts at scale against multiple targets.


Internet security monitoring group Shadowserver is tracking over 10,000 SharePoint servers currently exposed on the public internet with no visibility into how many have been patched since the vulnerability was assigned on May 21, 2026. This surveillance gap is critical: in the time between initial patch release and public CISA notification, defenders had no binding obligation to prioritize this flaw, creating an exploitation window that active threat actors have clearly exploited. The timing of CISA's formal notification and addition to its Known Exploited Vulnerabilities (KEV) catalog signals that in-the-wild exploitation has reached sufficient maturity and prevalence to warrant federal-level intervention.


## Severity and Impact


| Metric | Details |

|--------|---------|

| CVE Identifier | CVE-2026-45659 |

| CVSS v3.1 Base Score | 8.8 (High) |

| CVSS Vector | AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H |

| CWE | CWE-502: Deserialization of Untrusted Data |

| Attack Vector | Network (remotely exploitable from the internet) |

| Attack Complexity | Low (no special knowledge or setup required) |

| Privileges Required | Low (Site Member—minimum access level) |

| User Interaction | None required |

| Confidentiality Impact | High (full system compromise possible) |

| Integrity Impact | High (attacker can modify any data) |

| Availability Impact | High (attacker can disrupt or destroy service) |


## Affected Products


Microsoft SharePoint instances running the following versions are vulnerable to CVE-2026-45659 and require immediate patching:


  • SharePoint Enterprise Server 2016
  • SharePoint Server 2019
  • SharePoint Server Subscription Edition

    • Organizations running earlier end-of-support versions (SharePoint 2013 or older) should note that Microsoft does not provide security updates for these legacy deployments. If exploitation is detected on these systems, migration or retirement is the only remediation path.


    ## Mitigations


    Immediate Actions (By July 5, 2026 — Federal Deadline):


  • Apply Microsoft's security update released on May 21, 2026 to all affected SharePoint servers, whether they are internet-facing or internal-only
  • Federal Civilian Executive Branch agencies must complete patching by Saturday per CISA's Binding Operational Directive (BOD) 26-04
  • Private sector organizations should treat this deadline as a hard target for their own risk management and compliance postures

    • Network-Level Defenses:


  • Restrict SharePoint server access to authorized networks using firewall rules and network segmentation
  • Monitor authentication logs for anomalous Site Member activity, particularly failed logins followed by successful exploitation attempts
  • Implement anomaly detection rules for SharePoint data access patterns and configuration changes

    • Detection and Response:


  • Search web server logs for suspicious HTTP POST requests to SharePoint's web services endpoints
  • Monitor for process creation events spawned by the SharePoint application pool identity (typically w3wp.exe) executing unexpected binaries
  • Collect and preserve evidence of exploitation for forensic analysis and threat intelligence sharing

    • If Patching Is Delayed:


  • Discontinue public internet exposure of SharePoint servers using reverse proxy or VPN gatekeeping
  • Reduce the blast radius by enforcing stricter Site Member permission controls and auditing account assignments
  • Enable enhanced logging and real-time alerting for any authentication event from user accounts with SharePoint access

    • ## References


  • [CISA Known Exploited Vulnerabilities Catalog — CVE-2026-45659](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
  • [Microsoft SharePoint Security Updates (May 2026)](https://msrc.microsoft.com/)
  • [CISA Binding Operational Directive 26-04](https://www.cisa.gov/binding-operational-directives)
  • [Shadowserver Exposed Services Monitoring](https://www.shadowserver.org/)

    • ---


    ## HackWire Analysis


    The release-and-gap pattern in CVE-2026-45659 reflects a troubling reality in vulnerability management: patches exist, but enforcement mechanisms lag. Microsoft released the fix on May 21, yet it took until early July for CISA to formally catalog this as exploited, creating a six-week window where defenders had no regulatory pressure to prioritize the patch. Active exploitation filled that gap.


    This mirrors the April 2026 zero-day SharePoint flaw that CISA had to address just weeks prior. The pattern suggests either that SharePoint deserialization issues are a persistent code quality problem within Microsoft's engineering practices, or that threat actors have reverse-engineered Microsoft's patch deployment timelines and are deliberately scanning for unpatched instances during the lag period between patch release and public disclosure. Likely both.


    The federal deadline (BOD 26-04) creates a two-tier response: federal agencies have three days; everyone else has no deadline. In practice, this advantages large enterprises with formalized patch management while penalizing mid-market organizations and small businesses whose SharePoint administrators may not monitor CISA alerts in real time. The 10,000+ exposed instances that Shadowserver is tracking represent a credible target list for automated exploitation, and threat actors will absolutely prioritize lower-complexity targets (SMBs, smaller government entities) that lack 24/7 security operations capability.


    Organizations should treat CISA's KEV catalog addition as a leading indicator, not a lagging one. By the time a vulnerability is formally added to the catalog with active exploitation confirmed, you are already competing against automated scanning and worm-like propagation. Patching after notification is defensive; patching before notification, when possible, is strategic advantage.


    For SharePoint-dependent organizations, this is a forcing function to audit your attack surface: do you need SharePoint to be internet-facing at all? How many external users actually require Site Member access? If the deserialization flaw is the vector and authentication is the gating factor, reducing the pool of authenticated users is as valid a mitigation as patching the code.


    — *HackWire Editorial*


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)