CISA Warns of Microsoft SharePoint Server Code Execution Vulnerability Exploited in Attacks

Key Takeaways

• A critical deserialization vulnerability (CVE-2026-45659) in Microsoft SharePoint Server is actively being exploited in the wild.
• The flaw allows an authenticated attacker to achieve remote code execution (RCE) on affected on-premises SharePoint deployments.
• CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, mandating urgent remediation for federal agencies.
• Organizations running SharePoint Server must apply vendor-provided patches and mitigations immediately to prevent compromise.

CISA Issues Urgent Warning on Exploited SharePoint Server Vulnerability

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding a newly identified vulnerability in Microsoft SharePoint Server, designated CVE-2026-45659. This flaw, which permits remote code execution, has been observed in active exploitation, prompting CISA to add it to its KEV-listed vulnerabilities catalog.

The vulnerability stems from a deserialization of untrusted data issue (CWE-502). This allows an attacker, once authenticated, to craft and submit malicious data payloads that, when processed by the SharePoint server, can lead to arbitrary code execution over the network. This poses a significant threat to organizations utilizing on-premises SharePoint Server for critical collaboration and document management functions.

Understanding the Threat

According to CISA, the core of the issue lies in how SharePoint Server handles serialized data. An attacker with valid credentials can exploit this by injecting specially crafted serialized objects. When the server attempts to deserialize these objects, it inadvertently executes the attacker’s arbitrary code. This class of vulnerability is particularly dangerous as it can often bypass standard security mechanisms when leveraged within the context of legitimate user accounts.

CISA officially listed CVE-2026-45659 in its KEV catalog on July 1, 2026, with a stringent remediation deadline of July 4, 2026, for federal civilian executive branch agencies. This tight window underscores the severity and immediate risk posed by the active exploitation observed in real-world attacks. While there is no current public confirmation linking this specific vulnerability to ransomware campaigns, its active exploitation significantly elevates its risk profile for all organizations.

Mitigation and Defense Strategies

CISA has explicitly directed organizations to adhere to vendor-supplied mitigation guidance and comply with Binding Operational Directive (BOD) 26-04, which mandates a risk-based approach to prioritizing security updates. Organizations are strongly advised to assess any internet-facing SharePoint servers and apply all available patches or implement mitigations without delay.

Cybersecurity experts consistently highlight deserialization vulnerabilities as a persistent and effective attack vector in enterprise applications. In this scenario, an attacker could utilize stolen or low-privilege credentials to gain initial access, then leverage this flaw to escalate privileges and execute arbitrary code on the server. For instance, a compromised user account could be used to submit a malicious request that triggers the vulnerable deserialization process, enabling attackers to deploy web shells, establish persistent access, or further compromise the network.

Beyond immediate patching, CISA recommends implementing robust forensic triage procedures to detect potential compromise. Key indicators of compromise may include unusual activity within SharePoint, the execution of unexpected processes on the server, or anomalous network traffic originating from SharePoint servers.

The KEV catalog remains a vital tool for defenders, offering a curated list of vulnerabilities known to be actively exploited. By prioritizing the remediation of KEV-listed vulnerabilities like CVE-2026-45659, organizations can substantially reduce their exposure to ongoing threat campaigns. Given the short remediation timeline and the confirmed active exploitation, cybersecurity teams must treat this vulnerability as an urgent patching requirement. Procrastination could lead to the exposure of sensitive enterprise data and broader system compromise.

What You Should Do

• Patch Immediately: Apply all available security updates and patches from Microsoft for SharePoint Server without delay.
• Assess Exposure: Identify all on-premises SharePoint Server deployments, especially those exposed to the internet, and prioritize their patching.
• Review Access Controls: Strengthen authentication mechanisms and review user permissions to ensure the principle of least privilege is enforced.
• Monitor for Indicators of Compromise (IOCs): Implement enhanced monitoring for unusual SharePoint activity, unexpected process execution, and anomalous network traffic originating from SharePoint servers.
• Implement Network Segmentation: Isolate SharePoint servers from critical internal networks to limit potential lateral movement in case of a breach.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.