CVE-2026-45659: Microsoft SharePoint Server authenticated deserialization RCE, in CISA KEV
The short version: Microsoft SharePoint Server has a deserialization-of-untrusted-data flaw (CVE-2026-45659) that lets an authenticated attacker execute code over the network. It scores 8.8 and it's in CISA's Known Exploited Vulnerabilities catalog, so any low-privilege foothold — or a stolen credential — becomes a path to code execution on the server. If you run SharePoint on-premises, patch it. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — serious, but it requires an authenticated session |
| CVSS v3.1 (NVD) | 8.8 — High · AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 3.22% · 86.79th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2026-07-04 (BOD 26-04) |
| Known exploited? | Yes — added to KEV on 2026-07-01 |
| Vulnerability type | CWE-502 deserialization of untrusted data → remote code execution |
| Requires authenticated session? | Yes — low-privilege authenticated user |
| Affected | Microsoft SharePoint Server (2016, 2019, and Subscription Edition) — on-premises |
| Fixed in | The Microsoft security update for CVE-2026-45659 (see MSRC advisory) |
What you need to know
CVE-2026-45659 is a deserialization flaw: SharePoint Server reconstructs attacker-supplied serialized data into live objects without safely validating it, and a crafted payload turns that into code execution on the server. Unlike its unauthenticated cousin, this one needs a session — the attacker must be an authenticated user (the CVSS vector reflects low privileges required).
That distinction matters for how you rank it, but it doesn't make it safe:
- A foothold is common. Any authenticated user account — a phished credential, a low-privilege guest, a compromised mailbox — is enough to reach this.
- It's the document server. Code execution on SharePoint reaches the content it stores and the network around it.
- It's KEV-listed. CISA has confirmed exploitation and set a deadline.
This affects on-premises SharePoint Server. SharePoint Online (Microsoft 365) is managed by Microsoft.
How serious we see it
High — a notch below its unauthenticated sibling, and honestly so.
The authentication requirement is a real barrier that a purely external, credential-less attacker has to clear first — which is why we don't rate it Critical on sight. But "requires a login" is a low bar against an organization with any credential exposure, and CISA's KEV listing means this is being used, not theorized. The reassuring part: it affects specific on-premises builds, Microsoft has shipped a fix, and exposure is quick to confirm.
Recommendations
Straight from Microsoft's advisory and CISA:
- Patch now. Apply the Microsoft security update for CVE-2026-45659 to every on-premises SharePoint server.
- Tighten authentication. Enforce MFA and review who holds accounts that can reach SharePoint — this bug's precondition is a valid session.
- Hunt. Review server logs for unexpected process execution or new files, especially from low-privilege accounts.
- If you find indicators, respond. Rotate service-account credentials and machine keys and investigate for lateral movement.
- Confirm your exposure first. Verify whether you run affected on-premises SharePoint, and which build.
How BreachRisk sees it
BreachRisk discovers internet-facing SharePoint front-ends from little more than your domain, fingerprints the product and version, and flags exposure tied to KEV-listed vulnerabilities like this one so it rises to the top of your results rather than getting lost in a backlog.
That outside-in view answers the first question — do we run an exposed, affected SharePoint? — before you start reasoning about who might already hold a credential.