Any Employee Can Hack Your SharePoint. CVE-2026-45659 Is Now Actively Exploited — CISA KEV Deadline: July 4.
CVE-2026-45659 lets any authenticated SharePoint Site Member execute arbitrary code on the server. Microsoft rated exploitation "less likely" in May; CISA confirmed active exploitation on July 1 with a July 4 patch deadline, and over 10,000 servers remain exposed.
Any Employee Can Hack Your SharePoint. CVE-2026-45659 Is Now Actively Exploited — CISA KEV Deadline: July 4.
TL;DR
CVE-2026-45659 is a .NET deserialization remote code execution flaw in SharePoint that any authenticated user with basic Site Member permissions can trigger — no admin rights, no user interaction, network attack vector, low complexity. Microsoft patched it in May 2026 and rated exploitation "Less Likely." On July 1, 2026, CISA added it to the Known Exploited Vulnerabilities catalog with a July 4 remediation deadline, and Shadowserver is tracking over 10,000 SharePoint servers still exposed to the internet. Ransomware operators, including Storm-2603, already use compromised on-premises SharePoint as an initial access vector. The work now is to confirm which instances are patched and prove it, not to wait for the advisory to change.
What this is
CVE-2026-45659 is a remote code execution vulnerability in Microsoft SharePoint. SharePoint's .NET backend includes endpoints that deserialize data from incoming requests, and this CVE exploits a path where untrusted serialized data is processed without adequate validation.
The attacker needs a valid SharePoint account with Site Member permissions — the default access level assigned to virtually every employee in organizations using SharePoint, and one that external contractors, partners, and consultants often hold as well. Microsoft's advisory is explicit: "Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges." Attack complexity is Low, no user interaction is required, and the attack vector is Network, so it is remotely exploitable from the internet.
Microsoft published the CVE on May 22, 2026, with patches for SharePoint 2016, 2019, and Subscription Edition, and rated exploitation as "Less Likely." On July 1, 2026, CISA added it to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, with a remediation deadline of July 4, 2026 — 72 hours.
Why it matters
SharePoint is not just another web application. It is the operational backbone of enterprise collaboration: sensitive documents, internal workflows, intranet portals, deeply integrated with Active Directory, Exchange, and OneDrive. A compromised SharePoint server means an attacker has a foothold in the center of the enterprise infrastructure, with credentials, documents, and lateral movement paths to everything else.
The threat model is not limited to external attackers who steal admin credentials. It includes every single user with a SharePoint login: phished employees, disgruntled insiders, compromised contractor accounts, credentials from old breaches being reused. The pool of potential attackers is as large as your user base.
The SharePoint service account typically runs with elevated system privileges. Successful exploitation gives the attacker the ability to exfiltrate every document stored in SharePoint, including confidential contracts, financial data, intellectual property, and employee records. They can modify or destroy site content, install web shells, backdoors, or persistence mechanisms in the SharePoint directory structure, harvest credentials and Active Directory tokens from the server's memory and configuration, and pivot laterally to domain controllers, file servers, email systems, and other infrastructure connected to the SharePoint farm.
This is not theoretical. Microsoft's incident response teams have documented ransomware operators specifically targeting on-premises SharePoint servers as initial access vectors. Storm-2603 has been deploying Warlock ransomware through compromised SharePoint since mid-2025, exploiting known vulnerabilities in unpatched servers. In a recent investigation, Microsoft uncovered two unrelated threat groups operating simultaneously within the same compromised network, both using SharePoint vulnerabilities as their entry point — not coordinated, simply reflecting how many attackers independently target SharePoint as a high-value, frequently unpatched attack surface.
How it works
An attacker crafts a malicious serialized payload — typically using tools like ysoserial.NET to generate a .NET gadget chain — and submits it via an authenticated HTTP request to a vulnerable SharePoint endpoint. When SharePoint deserializes the payload, the gadget chain triggers, executing arbitrary code in the context of the SharePoint service account.
The affected versions and the patch levels released on May 22, 2026 are:
- SharePoint 2016 — 16.0.5552.1002
- SharePoint 2019 — 16.0.10417.20128
- SharePoint Subscription Edition — 16.0.19725.20280
Five weeks separated Microsoft's "Exploitation Less Likely" rating from CISA's confirmation of active exploitation. Government CERTs from Belgium, Singapore, Thailand, and Canada issued advisories urging immediate patching in late May and June 2026, and security media covered the vulnerability extensively, including a Medium post titled "Microsoft just admitted any employee can hack your company's SharePoint." Organizations that trusted the initial assessment and deprioritized the patch are now racing to remediate under a 72-hour deadline.
Detection and response
The hypothesis to test is whether any SharePoint instance in your estate is still running a build below the May 2026 patch level and is reachable by an authenticated low-privilege account.
Evidence that confirms or rejects it comes from four places. First, exposed asset and version data: Shadowserver is tracking over 10,000 SharePoint servers still exposed to the internet, and there is no public information on how many have been patched, so version and build checks against the fixed builds above are the starting point. Second, network evidence: unusual HTTP POST requests to SharePoint endpoints from authenticated low-privilege accounts, especially with large request bodies; outbound connections from the SharePoint server to unknown external IPs or C2 infrastructure; anomalous data transfers from the SharePoint server to external destinations. Third, log evidence: SharePoint ULS logs showing deserialization errors or unexpected object instantiation; IIS access logs with unusual request patterns or large POST bodies hitting SharePoint API endpoints; authentication logs showing low-privilege accounts accessing administrative or sensitive endpoints they do not normally touch. Fourth, host evidence: unexpected files in the SharePoint installation directory or wwwroot — web shells, typically .aspx files, scripts, or executables that were not part of the original deployment; new scheduled tasks or services created under the SharePoint service account context; and the SharePoint application pool worker process (w3wp.exe) spawning unusual child processes such as cmd.exe, powershell.exe, net.exe, curl.exe, or certutil.exe, or unexpected PowerShell execution with encoded or obfuscated commands originating from IIS worker processes.
If any of these indicators are present, treat it as a confirmed compromise. Isolate the SharePoint server immediately, engage your incident response process, and assume lateral movement has occurred.
What to do
- Inventory every SharePoint instance across all environments and subsidiaries — production, staging, test, forgotten, and inherited from acquisitions — and record the version and build of each one.
- Identify which instances are internet-facing and which accounts hold Site Member access, including contractors, partners, and consultants.
- Apply the May 2026 patches: 16.0.5552.1002 for SharePoint 2016, 16.0.10417.20128 for 2019, and 16.0.19725.20280 for Subscription Edition.
- Hunt for the indicators of compromise above in network traffic, SharePoint ULS logs, IIS access logs, authentication logs, the file system, and process monitoring.
- If indicators are found, isolate the server, start incident response, and assume lateral movement.
- After patching, re-verify that the deserialization endpoint is no longer exploitable, so "patched" is a verified fact rather than a Windows Update log entry.
- Re-scan when new SharePoint instances deploy, so instances that appear after the initial patch wave do not reopen the exposure.
FAQ
Who can exploit CVE-2026-45659? Any authenticated attacker with a valid SharePoint account holding basic Site Member permissions. Microsoft's advisory states it does not require admin or other elevated privileges, attack complexity is Low, no user interaction is required, and the attack vector is Network.
When was it patched, and when was exploitation confirmed? Microsoft published the CVE and released patches on May 22, 2026, rating exploitation "Less Likely." CISA added it to the Known Exploited Vulnerabilities catalog on July 1, 2026, confirming active exploitation, with a July 4, 2026 remediation deadline — 72 hours.
Which versions are affected and what are the fixed builds? SharePoint 2016, 2019, and Subscription Edition. The fixed builds are 16.0.5552.1002 for SharePoint 2016, 16.0.10417.20128 for 2019, and 16.0.19725.20280 for Subscription Edition.
How many servers are still exposed? Shadowserver is tracking over 10,000 SharePoint servers still exposed to the internet. There is no public information on how many have been patched.
Is this being used by ransomware operators? Yes. Storm-2603 has been deploying Warlock ransomware through compromised on-premises SharePoint servers since mid-2025, and Microsoft's investigation found two unrelated threat groups operating simultaneously in the same compromised network, both entering through SharePoint vulnerabilities.
What does successful exploitation give an attacker? Code execution in the context of the SharePoint service account, which typically runs with elevated system privileges — enabling document exfiltration, content modification or destruction, web shell and persistence installation, credential and Active Directory token harvesting, and lateral movement to domain controllers, file servers, and email systems.
What should we do if we find indicators of compromise? Treat it as a confirmed compromise: isolate the SharePoint server immediately, engage your incident response process, and assume lateral movement has occurred.