CVE-2026-45659: Microsoft SharePoint Server deserialization flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityActively exploited per CISA KEV with known ransomware use, very high EPSS, and remote code execution impact on a widely deployed server product.

What it is

Microsoft SharePoint Server deserializes untrusted data, letting an authenticated attacker run code over the network. The flaw is remotely reachable, needs no user interaction, and carries high impact to confidentiality, integrity and availability. It is in CISA's KEV catalog with known ransomware use, so it is being exploited in the wild.

Impact

An attacker with a valid low-privileged account can execute arbitrary code on the SharePoint server, gaining control of the host and its data. Because the same flaw is tied to ransomware campaigns, compromise can extend to lateral movement and data encryption.

Attack surface

Reached over the network via the SharePoint web interface (AV:N), requiring only low privileges (PR:L) and no user interaction (UI:N). No public-facing exposure detail is given beyond the network vector, so internet-facing instances should be treated as the highest risk.

Exploitation

Listed in CISA KEV (added 2026-07-01, due 2026-07-04) with known ransomware campaign use, and EPSS 30-day probability 0.76075 (99.5th percentile), indicating active exploitation is expected.

What to do

• Apply the Microsoft vendor update for CVE-2026-45659 immediately, following CISA BOD 26-04 guidance.
• If patching is not possible, apply vendor mitigations or discontinue use of the affected SharePoint service.
• Restrict network access to SharePoint servers and remove internet exposure where feasible.
• Enforce least privilege and review accounts with SharePoint access for unnecessary permissions.
• Monitor for and rotate credentials of any accounts suspected of compromise.

Detection

• Hunt for unusual w3wp.exe or SharePoint worker process spawning child processes such as cmd.exe, powershell.exe or scripting hosts.
• Review SharePoint IIS and ULS logs for anomalous POST requests or deserialization-related errors around the exploitation window.
• Monitor for known ransomware precursor activity and outbound connections from SharePoint servers.
• Alert on new or modified web shells and unexpected files in SharePoint directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.