Loading vulnerability…
CVE-2026-45659 is a high-severity remote code execution vulnerability in on-premises Microsoft SharePoint Server caused by deserialization of untrusted data. The flaw affects Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition prior to the vendor-fixed builds. Microsoft describes the issue as allowing an authorized attacker to execute code over a network, and multiple advisories further indicate that low-privileged authenticated users, including users with Site Member-level access, may be sufficient to trigger exploitation. The vulnerability is associated with unsafe handling of attacker-controlled serialized data within SharePoint, enabling arbitrary code execution in the server context when malicious input is processed. The issue has been added to CISA's Known Exploited Vulnerabilities catalog and has been confirmed as exploited in the wild, including in ransomware activity.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
Repository contains a documented proof-of-concept and detection notes for SharePoint /_trust WS-Federation SecurityContextToken deserialization leading to unauthenticated RCE and machine-key theft. Structure is small and focused: README and index.html provide the writeup; detection/hunting.md contains defender-oriented hunting guidance; artifacts/ contains redacted example telemetry; scripts/ contains the actual exploit code. The main exploit capability is in scripts/cve-2026-58644_oob_param.ps1. It is a parameterized PowerShell exploit that builds a PowerShell payload, base64-encodes it for -EncodedCommand, invokes ysoserial.net to generate a BinaryFormatter gadget (default TypeConfuseDelegate), wraps the raw gadget bytes with System.IdentityModel.DeflateCookieTransform, embeds that into a crafted WS-Federation RequestSecurityTokenResponse, and POSTs it to $Target/_trust/default.aspx with wa=wsignin1.0. Capabilities include arbitrary command execution, optional HTTP callback/beaconing, optional file drop, optional diagnostic exfiltration, proxy support, and optional direct powershell execution via --rawcmd to avoid cmd.exe in the process tree. The second exploit, scripts/cve-2026-58664_machinekeys.ps1, is a two-stage PowerShell exploit for in-process machine-key disclosure. It generates two ysoserial payloads: a preamble using ActivitySurrogateDisableTypeCheck and a main payload using ActivitySurrogateSelectorFromFile to compile embedded C# code (KeyDump) inside w3wp.exe. That C# reflects into System.Web.Configuration.MachineKeySection, extracts ValidationKey/DecryptionKey and related settings, clears the HTTP response, and writes the values back between sentinel markers. This is more stealthy than the OOB RCE path because it avoids child process creation and external beaconing. Overall, this is a real exploit repository rather than a detector-only repo. It is not part of a major exploitation framework. The code is operational but still PoC-style: payloads are customizable through parameters, but execution depends on an external ysoserial.net binary and a vulnerable SharePoint deployment. The most fingerprintable target artifact across both scripts is POST traffic to /_trust/default.aspx carrying wa=wsignin1.0 and a RequestSecurityTokenResponse/SecurityContextToken body.
This repository is a small standalone Python exploit project consisting of one main script (`CVE-2026-45659.py`), a README, and a minimal `.gitignore`. It is not part of a known exploitation framework. The script is presented as an authenticated RCE exploit for a claimed SharePoint deserialization issue, CVE-2026-45659, affecting SharePoint Server 2019, 2022, and Subscription Edition before May 2026. The exploit’s structure is straightforward: it defines a banner, a payload generator, a `SharePointClient` class for HTTP interaction, and a `main()` CLI entry point. The payload generator creates a base64-encoded JSON structure that simulates a malicious .NET deserialization chain using `System.Diagnostics.Process` / `ProcessStartInfo` to run an operator-supplied command. This is notable because the code comments explicitly state the payload is a simplified simulation rather than a full LosFormatter/ObjectStateFormatter gadget chain, suggesting the repository is more of an operational proof-of-concept than a fully weaponized exploit. The client logic uses Python’s standard `urllib` stack with optional SSL verification disabling, Basic Authorization headers, JSON/ODATA-style headers, and support for request digest handling (`X-RequestDigest`) typical of SharePoint state-changing operations. Based on the visible code and README, the exploit authenticates to a SharePoint site, obtains any required anti-CSRF/request digest token, and then attempts to exploit list item update functionality in a specified `SiteName/ListName` path to deliver the serialized payload. The CLI requires target URL, username, password, and site/list path, and optionally accepts a command, proxy, timeout, SSL verification, and a `--shell` mode. Capabilities: authenticated remote command execution against a SharePoint server via crafted serialized data delivered through list item update operations. The default command is `whoami /all`, but the operator can supply arbitrary commands. The payload is hardcoded in structure but customizable in command content, which supports an OPERATIONAL maturity assessment rather than pure POC or framework-grade weaponization. Fingerprintable observables are limited. The repository contains example target and proxy URLs in the README (`https://sharepoint.target.com`, `http://127.0.0.1:8080`), a reference URL to NVD, and author contact/branding URLs. Within the exploit code, the most relevant execution artifacts are `cmd.exe` and `/bin/bash`, which are the process launch targets embedded in the payload. The exact SharePoint REST/API paths are not fully visible in the provided truncated content, but the code clearly constructs requests by concatenating a user-supplied base target with internal request paths and uses SharePoint-specific headers and digest tokens. Overall, this repository appears to be a real exploit script rather than a detection tool or fake destructive sample. However, because the visible payload generation is explicitly described as a simplified simulation of a true .NET deserialization chain, the code should be treated as a plausible exploit PoC/operational script whose success may depend on omitted functions and target-specific SharePoint behavior.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
334 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote code execution vulnerability affecting Microsoft SharePoint. The content appears to contain a duplicated CVE suffix.
A high-severity remote code execution vulnerability in Microsoft SharePoint caused by deserialization of untrusted data, allowing low-privileged attackers to execute arbitrary code on unpatched servers.
A SharePoint deserialization vulnerability that allows a low-privileged attacker to execute arbitrary code and has been confirmed exploited in ransomware campaigns.
Another SharePoint vulnerability mentioned only as background comparison in a list of previously confirmed exploited flaws.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.