CVE-2026-45659: The SharePoint RCE That's Now Under Active Exploitation

A SharePoint Server bug that Microsoft quietly patched back in May is now the thing you need to deal with today. On July 1, 2026, CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalog, confirming it’s being used in real attacks, and set a remediation deadline of July 4. If your organization runs on-premises SharePoint, that’s not a lot of runway.

What the bug actually is

CVE-2026-45659 is a deserialization-of-untrusted-data vulnerability in on-premises SharePoint Server. CVSS 8.8. The mechanism is the classic deserialization problem: SharePoint accepts serialized data from a request, deserializes it without sufficiently validating what’s inside, and an attacker who controls that payload gets it executed on the server.

What makes this one nasty isn’t novelty, deserialization bugs in enterprise software are not new, it’s the privilege bar. The attacker needs to be authenticated, but only with Site Member permissions. That’s not an admin account. In most SharePoint deployments, Site Member is closer to “any employee with a login” than “privileged operator.” Low attack complexity plus a low privilege requirement is the combination that turns a bug into a weekend incident.

Who’s affected

Three on-prem editions:

• SharePoint Server Subscription Edition (fixed in build 16.0.19725.20280)
• SharePoint Server 2019
• SharePoint Server 2016

SharePoint Online, the Microsoft 365 cloud service, is not affected. Microsoft patches that centrally and it was never in scope for this bug. If your organization uses SharePoint Online exclusively, this specific CVE doesn’t apply to you, though it’s worth double-checking whether any team spun up an on-prem instance you don’t know about.

Timeline

• May 21, 2026: Microsoft ships the fix, including out-of-band updates for affected builds.
• July 1, 2026: CISA adds CVE-2026-45659 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.
• July 4, 2026: CISA’s remediation deadline for federal civilian agencies under Binding Operational Directive 26-04.

The six-week gap between patch release and KEV addition is worth noting on its own. It means attackers had a working exploit and a population of unpatched servers to hit well before CISA’s public confirmation. If you saw the May advisory and filed it under “patch eventually,” this is the moment that assumption stopped being safe.

What to do today

Patch first. Check your SharePoint Server build number against Microsoft’s fixed builds and apply the update if you haven’t. This is the only real fix; nothing else below substitutes for it.

Then check whether you were already hit. Because the exploit only needs Site Member-level access, review authentication and request logs for the window between May 21 and whenever you actually patched. Look for Site Member accounts making requests that don’t match their normal usage pattern, particularly anything hitting endpoints tied to content deserialization.

If you can’t patch immediately, restrict external and untrusted network access to your SharePoint Server farm as a stopgap. This isn’t a substitute for patching, it buys time, not safety.

Don’t assume federal-only urgency applies to you. BOD 26-04’s July 4 deadline is binding on federal civilian agencies, but CISA’s KEV catalog exists precisely because private-sector and state/local organizations use the same signal to prioritize. Active exploitation doesn’t check who owns the server.

The pattern worth remembering

This is the third deserialization-driven enterprise RCE to hit KEV in as many months, following a run of similar bugs across other on-prem enterprise platforms. Deserialization vulnerabilities keep showing up in mature enterprise software for a structural reason: these products were built for an era when “authenticated user” and “trusted user” were treated as close to synonymous. Modern threat models don’t make that assumption, and the code hasn’t always caught up.

If you’re doing a broader audit of your infrastructure’s exposure, our technical due diligence guide covers how to systematically check for this class of risk rather than reacting one CVE at a time. And if authentication design in general is part of what you’re reviewing, the tradeoffs between OAuth, OIDC, and SAML are worth understanding alongside patch management, since access control gaps and unpatched deserialization bugs tend to compound each other.

Patch SharePoint Server today if you haven’t. Then go check your logs.