CISA Flags Actively Exploited SharePoint RCE CVE-2026-45659

CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalog after confirming active attacks against Microsoft SharePoint Server. The high-severity flaw is a deserialization of untrusted data issue that lets an authenticated attacker with only Site Member permissions execute arbitrary code on vulnerable, internet-exposed servers, with no user interaction required and low attack complexity. Microsoft said the bug is easy to exploit with repeatable success and released fixes in late May after the CVE was initially omitted from its May 2026 security updates.

The vulnerability affects SharePoint Server Subscription Edition, SharePoint Server 2019, SharePoint Server 2016, and SharePoint Enterprise Server 2016. CISA ordered Federal Civilian Executive Branch agencies to remediate the issue within days under BOD 26-04, while internet scanning data cited by Shadowserver shows more than 10,000 SharePoint servers remain exposed online. Separately, Microsoft disclosed a ransomware investigation involving Storm-2603 and another threat actor operating in the same compromised environment, where the attackers used persistence, remote access tools, privilege escalation, and defense evasion after initial access was likely obtained through CVE-2025-11371 in Gladinet Triofox.