CISA has added a Microsoft SharePoint Server remote-code-execution flaw to its Known Exploited Vulnerabilities catalog after evidence that attackers are now using it in the wild, turning a May security update into an immediate patch-and-triage problem for organizations still running on-prem SharePoint.
The vulnerability, tracked as CVE-2026-45659, affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. CISA lists the flaw as added on July 1, 2026, with a July 4, 2026, remediation deadline for U.S. federal civilian agencies. The agency’s required action is not just to apply vendor mitigations, but also to follow risk-based patching guidance and forensic triage requirements.
For private-sector teams, the federal deadline is still useful. It signals that the issue has moved past theoretical risk and into the small set of vulnerabilities defenders should treat as urgent, especially when SharePoint is internet-reachable, exposed through remote access paths, or tied closely to Microsoft 365 identity, file-sharing, and collaboration workflows.
What CVE-2026-45659 allows
CVE-2026-45659 is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint. NVD lists it with a CVSS 3.1 score of 8.8, with network attack vector, low attack complexity, low privileges required, no user interaction, and high impact to confidentiality, integrity, and availability.
The low-privilege requirement is the detail that matters operationally. This is not described as a fully unauthenticated bug, but Microsoft and NVD’s scoring indicate that an authorized attacker can execute code over the network without needing administrative rights or a user to click through a lure. In a real environment, that makes weak accounts, compromised credentials, stale guest access, and overbroad site membership more dangerous.
Help Net Security reported when the patch was released that exploitation would require the attacker to authenticate first, but that the attack complexity was low once the attacker had access. The same report noted Microsoft’s update that customers who had already installed the May 2026 SharePoint updates did not need additional patch action because the CVE had been fixed in those updates, even though it was initially omitted from the May security-update listing.
Affected SharePoint builds to check
SharePoint Online in Microsoft 365 is not the center of this advisory. The affected products are the on-premises server editions that organizations still run for intranet sites, document workflows, regulated environments, custom integrations, and hybrid deployments.
NVD’s enriched record lists the vulnerable build ranges as follows:
- SharePoint Enterprise Server 2016 versions before 16.0.5552.1002
- SharePoint Server 2019 versions before 16.0.10417.20128
- SharePoint Server Subscription Edition versions before 16.0.19725.20280
Those build numbers give administrators a concrete first check. Patch dashboards can lag, inventories may miss retired-but-running systems, and SharePoint farms often include multiple servers that need to be brought to a consistent state. The useful question is not only whether the May update was approved, but whether every relevant web front end and application server is actually running a fixed build.
Why this SharePoint flaw deserves faster handling
SharePoint is a high-value target because it sits close to business documents, identity context, internal search, collaboration spaces, and workflow data. Even when a vulnerability requires authentication, attackers may already have a foothold through password reuse, phishing, token theft, exposed VPN accounts, or compromised third-party users.
The active-exploitation signal also changes the response sequence. A normal May patch might be handled through the next maintenance window. A CISA KEV entry asks a different question: could the system have been reached before the update was applied, and is there evidence that a low-privilege account was used to gain more dangerous execution on the server?
Public reporting so far has not established who is exploiting CVE-2026-45659, what payloads are being used, or whether the activity is tied to ransomware, espionage, initial-access sales, or opportunistic scanning. That lack of detail is not a reason to wait. It means defenders should preserve logs and run checks before routine log rotation erases the narrow window they most need to understand.
What SharePoint admins should do now
The first step is to identify every on-prem SharePoint Server instance, including test farms, legacy intranet systems, disaster-recovery servers, and systems reachable only through VPN or partner networks. From there, administrators should verify the installed build against Microsoft’s fixed versions instead of relying only on patch-deployment status.
- Confirm whether SharePoint Server Subscription Edition, SharePoint Server 2019, or SharePoint Enterprise Server 2016 is in use.
- Verify each server’s build number and confirm it is at or above the fixed build for that product line.
- Review whether any SharePoint endpoints are internet-accessible or reachable from unmanaged networks.
- Check for suspicious activity from low-privilege accounts, newly added site members, unexpected service-account usage, and authentication events that precede unusual server behavior.
- Preserve IIS logs, SharePoint ULS logs, Windows event logs, endpoint telemetry, and any web-shell or file-integrity alerts before rolling retention windows expire.
- Review recent file writes, scheduled tasks, new services, unusual PowerShell activity, and unexpected process launches on SharePoint servers.
- Restrict broad site membership and stale accounts that could give an attacker the low-privilege access needed to trigger the flaw.
Organizations subject to federal requirements should follow CISA’s KEV and BOD 26-04 instructions directly. Other organizations can still use the same structure: patch quickly, validate exposure, perform targeted forensic triage, and document whether the vulnerable system was reachable during the exploitation window.
The practical bottom line
CVE-2026-45659 is not the loudest kind of SharePoint emergency because it requires authentication and was already patched in May. But active exploitation changes the priority. Any organization running on-prem SharePoint should treat the July 4 federal deadline as a marker for urgency, not as a government-only requirement.
The safest path is straightforward: find every SharePoint Server farm, prove the build level, reduce unnecessary exposure, and check for signs that a low-privilege account was used in a way that does not fit normal collaboration behavior. The patch closes the known hole; the triage tells you whether someone got there first.
