Actively Exploited SharePoint Server RCE Added to CISA KEV
Active Exploitation · 5 sources · Updated 4mo ago · First seen Jul 7, 2026
CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a high-severity remote code execution flaw in on-premises Microsoft SharePoint Server. The vulnerability stems from deserialization of untrusted data (CWE-502) and carries a CVSS 8.8 score. It affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition below patched versions, and can be exploited over the network by an authenticated attacker with low privileges such as Site Member, without user interaction.
Microsoft issued fixes in its May 2026 security updates, later clarifying that the CVE had been inadvertently omitted from the initial update list. CISA set a July 4, 2026 remediation deadline for federal civilian agencies under Binding Operational Directive 22-01, while public reporting said the exact vulnerable SharePoint component, gadget chain, payload delivery method, and any connection to ransomware activity had not yet been disclosed. Security guidance accompanying the KEV listing urged organizations to patch immediately and review exposed SharePoint environments for signs of compromise.
