Loading vulnerability…
CVE-2026-45659 is a high-severity remote code execution vulnerability in on-premises Microsoft SharePoint Server caused by deserialization of untrusted data. The flaw affects supported SharePoint Server Subscription Edition, SharePoint Server 2019, SharePoint Server 2016, and SharePoint Enterprise Server 2016 builds prior to the vendor-fixed versions. Successful exploitation allows code execution on the SharePoint server over the network. Available reporting indicates the vulnerability is exploitable by an authenticated attacker with low privileges, including at least Site Member-level access. The weakness arises from unsafe handling of attacker-controlled serialized data within SharePoint, enabling arbitrary code execution in the server context.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
Repository contains a documented proof-of-concept and detection notes for SharePoint /_trust WS-Federation SecurityContextToken deserialization leading to unauthenticated RCE and machine-key theft. Structure is small and focused: README and index.html provide the writeup; detection/hunting.md contains defender-oriented hunting guidance; artifacts/ contains redacted example telemetry; scripts/ contains the actual exploit code. The main exploit capability is in scripts/cve-2026-58644_oob_param.ps1. It is a parameterized PowerShell exploit that builds a PowerShell payload, base64-encodes it for -EncodedCommand, invokes ysoserial.net to generate a BinaryFormatter gadget (default TypeConfuseDelegate), wraps the raw gadget bytes with System.IdentityModel.DeflateCookieTransform, embeds that into a crafted WS-Federation RequestSecurityTokenResponse, and POSTs it to $Target/_trust/default.aspx with wa=wsignin1.0. Capabilities include arbitrary command execution, optional HTTP callback/beaconing, optional file drop, optional diagnostic exfiltration, proxy support, and optional direct powershell execution via --rawcmd to avoid cmd.exe in the process tree. The second exploit, scripts/cve-2026-58664_machinekeys.ps1, is a two-stage PowerShell exploit for in-process machine-key disclosure. It generates two ysoserial payloads: a preamble using ActivitySurrogateDisableTypeCheck and a main payload using ActivitySurrogateSelectorFromFile to compile embedded C# code (KeyDump) inside w3wp.exe. That C# reflects into System.Web.Configuration.MachineKeySection, extracts ValidationKey/DecryptionKey and related settings, clears the HTTP response, and writes the values back between sentinel markers. This is more stealthy than the OOB RCE path because it avoids child process creation and external beaconing. Overall, this is a real exploit repository rather than a detector-only repo. It is not part of a major exploitation framework. The code is operational but still PoC-style: payloads are customizable through parameters, but execution depends on an external ysoserial.net binary and a vulnerable SharePoint deployment. The most fingerprintable target artifact across both scripts is POST traffic to /_trust/default.aspx carrying wa=wsignin1.0 and a RequestSecurityTokenResponse/SecurityContextToken body.
This repository is a small standalone Python exploit project consisting of one main script (`CVE-2026-45659.py`), a README, and a minimal `.gitignore`. It is not part of a known exploitation framework. The script is presented as an authenticated RCE exploit for a claimed SharePoint deserialization issue, CVE-2026-45659, affecting SharePoint Server 2019, 2022, and Subscription Edition before May 2026. The exploit’s structure is straightforward: it defines a banner, a payload generator, a `SharePointClient` class for HTTP interaction, and a `main()` CLI entry point. The payload generator creates a base64-encoded JSON structure that simulates a malicious .NET deserialization chain using `System.Diagnostics.Process` / `ProcessStartInfo` to run an operator-supplied command. This is notable because the code comments explicitly state the payload is a simplified simulation rather than a full LosFormatter/ObjectStateFormatter gadget chain, suggesting the repository is more of an operational proof-of-concept than a fully weaponized exploit. The client logic uses Python’s standard `urllib` stack with optional SSL verification disabling, Basic Authorization headers, JSON/ODATA-style headers, and support for request digest handling (`X-RequestDigest`) typical of SharePoint state-changing operations. Based on the visible code and README, the exploit authenticates to a SharePoint site, obtains any required anti-CSRF/request digest token, and then attempts to exploit list item update functionality in a specified `SiteName/ListName` path to deliver the serialized payload. The CLI requires target URL, username, password, and site/list path, and optionally accepts a command, proxy, timeout, SSL verification, and a `--shell` mode. Capabilities: authenticated remote command execution against a SharePoint server via crafted serialized data delivered through list item update operations. The default command is `whoami /all`, but the operator can supply arbitrary commands. The payload is hardcoded in structure but customizable in command content, which supports an OPERATIONAL maturity assessment rather than pure POC or framework-grade weaponization. Fingerprintable observables are limited. The repository contains example target and proxy URLs in the README (`https://sharepoint.target.com`, `http://127.0.0.1:8080`), a reference URL to NVD, and author contact/branding URLs. Within the exploit code, the most relevant execution artifacts are `cmd.exe` and `/bin/bash`, which are the process launch targets embedded in the payload. The exact SharePoint REST/API paths are not fully visible in the provided truncated content, but the code clearly constructs requests by concatenating a user-supplied base target with internal request paths and uses SharePoint-specific headers and digest tokens. Overall, this repository appears to be a real exploit script rather than a detection tool or fake destructive sample. However, because the visible payload generation is explicitly described as a simplified simulation of a true .NET deserialization chain, the code should be treated as a plausible exploit PoC/operational script whose success may depend on omitted functions and target-specific SharePoint behavior.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
301 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Microsoft SharePoint Server vulnerability listed among vulnerabilities actively exploited or operationally weaponized in July 2026.
A Microsoft SharePoint Server vulnerability discussed as one of three flaws being actively exploited, enabling serious post-compromise outcomes including authentication bypass, code execution, credential/key theft, persistence, and malware deployment.
Another SharePoint vulnerability mentioned as having exploitation come to light in recent weeks.
A previously disclosed high-severity Microsoft SharePoint Server remote code execution vulnerability caused by deserialization of untrusted data, mentioned as background context and noted as added to CISA KEV.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.