# Microsoft SharePoint Server Flaw Under Active Exploitation — CISA Adds CVE-2026-45659 to KEV Catalog
Microsoft SharePoint Server is under active attack. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed this week that a critical remote code execution vulnerability in SharePoint has been exploited in the wild, prompting the agency to add the flaw to its Known Exploited Vulnerabilities (KEV) catalog — a designation that triggers urgent patching requirements for federal agencies and critical infrastructure operators.
The vulnerability, tracked as CVE-2026-45659, allows an unauthenticated attacker to execute arbitrary code on affected servers by sending a specially crafted request that exploits unsafe deserialization of untrusted data. With a CVSS severity score of 8.8 and evidence of active exploitation already documented, organizations running SharePoint Server on-premises need to treat this as an immediate priority.
## The Threat
CVE-2026-45659 is a remote code execution flaw stemming from improper handling of serialized objects in Microsoft SharePoint Server. The vulnerability exists in a component that deserializes data without sufficiently validating its source or structure. An attacker can craft a malicious serialized payload and send it to the affected SharePoint Server, causing it to execute arbitrary code with the privileges of the web application pool identity — typically a high-privileged account in enterprise environments.
What makes this vulnerability particularly dangerous is its accessibility. Unlike many SharePoint flaws that require authentication or specific network positioning, CVE-2026-45659 can be triggered by an unauthenticated attacker making a simple HTTP request. No credentials are required, no special configuration is necessary, and the attack is trivial to automate. This combination of ease-of-exploitation and code execution capability explains why the vulnerability is already being weaponized in active attacks.
The fact that CISA added this to the KEV catalog signals that exploitation is not theoretical or limited to security research. Multiple threat actors have developed working exploits and are actively scanning for and compromising vulnerable SharePoint installations. Organizations should assume their perimeter is under reconnaissance if they have an unpatched SharePoint Server exposed to the internet.
## Severity and Impact
| Aspect | Details |
|--------|---------|
| CVE ID | CVE-2026-45659 |
| CVSS v3.1 Score | 8.8 (High) |
| Vector String | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | High |
| CWE | CWE-502 (Deserialization of Untrusted Data) |
| CISA KEV Status | Added to Known Exploited Vulnerabilities catalog |
| Exploitation Status | Active, in-the-wild exploitation confirmed |
The CVSS score of 8.8 reflects the severity accurately: an attacker with no special privileges or access can achieve complete system compromise, including reading sensitive data, modifying files and configurations, and disrupting services. In a SharePoint environment, this typically means access to all documents stored in the collaboration platform, email archives, and potentially lateral movement to other systems on the corporate network.
## Affected Products
Microsoft SharePoint Server versions affected by CVE-2026-45659 include:
Additionally, organizations running Microsoft SharePoint Online as part of Microsoft 365 should verify with Microsoft whether their environment is affected, though early indications suggest the online service is not vulnerable due to architectural differences.
On-premises deployments are the primary target for active exploitation. Organizations running older versions of SharePoint Server (2013 or 2016) face particular urgency, as these versions may have extended support ending or already ended. Third-party security vendors should be consulted about alternative mitigations if upgrading is not immediately feasible.
## Mitigations
Immediate Actions (within 24–48 hours):
1. Apply the security update immediately — Microsoft has released patches for affected versions. Prioritize patching SharePoint servers, especially those accessible from the internet or DMZ environments. Test patches in a staging environment first if possible, but do not delay patching production systems.
2. Network segmentation — If patching cannot be applied immediately, restrict network access to SharePoint Server through web application firewalls (WAF), network access control lists (ACLs), or IP allowlisting. Limit access to only trusted sources.
3. Monitor for exploitation — Enable logging on SharePoint servers and review logs for:
- HTTP requests containing serialized object payloads (look for base64-encoded data in POST requests)
- Unusual process execution from the w3wp.exe (IIS worker) process
- File system modifications in unexpected directories
- Unexpected outbound connections from SharePoint application pools
4. Disable unnecessary services — If SharePoint services not in use can be disabled without disrupting operations, reduce the attack surface accordingly.
Short-term Protections (1–2 weeks):
5. Credential rotation — Assume any system with direct access to your SharePoint Server (service accounts, farm administrators) may be compromised. Rotate passwords for service accounts that run the SharePoint application pool.
6. Audit access logs — Review SharePoint usage logs and IIS logs for the past 30 days to identify any suspicious activity or indicators of compromise (IOCs) that may indicate prior exploitation.
7. Endpoint detection — Deploy or enhance endpoint detection and response (EDR) tools to monitor SharePoint servers for post-exploitation activity (lateral movement, credential theft, persistence mechanisms).
Long-term Strategy:
8. Patch management automation — Implement automated patch management for SharePoint and all Microsoft products to reduce future vulnerability windows.
9. Upgrade end-of-support versions — Develop a timeline to upgrade SharePoint 2013 and 2016 deployments to 2019 or migrate to SharePoint Online to eliminate ongoing vulnerability exposure.
## References
## HackWire Analysis
CVE-2026-45659 represents a critical vulnerability class that continues to plague enterprise software: unsafe deserialization. Microsoft has patched similar issues in Exchange, Dynamics, and other enterprise products, yet deserialization flaws keep reappearing. The pattern is telling — developers often underestimate the risk of processing untrusted serialized objects, assuming that the serialization format itself provides security.
What distinguishes this SharePoint flaw is its positioning at the perimeter. Unlike many enterprise vulnerabilities that require internal network access or authentication, this is wormable in practical terms — a single HTTP request can compromise an entire SharePoint farm. For attackers, this is high-value real estate: SharePoint instances typically house sensitive corporate documents, email archives, project files, and intellectual property. A compromised SharePoint farm is not just a technical incident — it's a data exfiltration incident waiting to happen.
The active exploitation timeline is also significant. The fact that working exploits are already in the wild and CISA has added this to the KEV catalog means defenders are in a race against threat actors who are actively scanning and compromising systems *right now*. Organizations that delay patching by even a few days are rolling the dice against motivated adversaries with automated exploitation tools. This is not a future threat — it's a current threat with real attackers and victims.
The vulnerability's impact extends beyond confidentiality. A compromised SharePoint Server gives attackers a foothold to pivot to other systems: directory services, email servers, VPN infrastructure, and backend databases. In incident response investigations, we consistently see SharePoint breaches as the initial access point for broader network compromise. Organizations should treat this not as an isolated SharePoint patch, but as a network-wide incident prevention effort.
For enterprises running older unsupported versions (SharePoint 2013), the situation is graver. Microsoft will not release patches for end-of-support products. Organizations in this position must choose between accepting the risk, implementing aggressive network controls, or accelerating their migration strategy. Continuing to run unpatched end-of-support software exposed to the internet is indefensible from a governance and risk management perspective.
— HackWire Editorial
## Related Coverage