CVE-2026-45659 — Microsoft SharePoint Server: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

1. Executive summary

Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability (CVE-2026-45659, CVSS 8.8 HIGH, CWE-502) enabling authenticated, remote code execution over a network with low attack complexity and no user interaction required. The flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 2026-07-01, citing evidence of active exploitation, with a remediation due-date of 2026-07-04. EMEA financial services running internet-exposed SharePoint instances face immediate RCE risk from authenticated attackers; the low privilege requirement (PR:L) means any low-privilege SharePoint account is a viable entry point.

2. Regulatory framing

3. Technical analysis & attack chain

Vulnerability mechanism: CVE-2026-45659 is a deserialization of untrusted data vulnerability (CWE-502) in Microsoft Office SharePoint Server. The NVD-assigned CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, confirming: network-expposable, low attack complexity, low-privilege authentication required, no user interaction, and high impact across confidentiality, integrity, and availability. The CNA is Microsoft Corporation.

Affected versions (per Help Net Security, corroborated by BSI Germany)

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Enterprise Server 2016

Attack chain (confirmed steps)

1. Initial access / authentication: The attacker possesses valid SharePoint credentials at any privilege level (PR:L). No specialised conditions are required (per The Hacker News, corpus-1). The attack complexity is Low (AC:L) because the vulnerability does not require winning a race condition or meeting unusual preconditions.
2. Exploit delivery: The attacker sends a crafted payload to the vulnerable SharePoint Server instance that triggers deserialization of untrusted data. The payload is delivered over the network (AV:N). No user interaction is required (UI:N).
3. Code execution: The deserialization of the attacker-controlled data results in arbitrary code execution on the SharePoint Server in the context of the SharePoint application/service account. Given C:H/I:H/A:H, the attacker achieves full confidentiality, integrity, and availability impact — consistent with "total" technical impact in CISA's SSVC assessment.
4. Post-exploitation (inferred from CVSS impact metrics, not directly observed in sources): With code execution as the SharePoint service account, the attacker may access SharePoint content databases, configuration data, and potentially pivot to other systems depending on the service account's privileges and network position.

CISA SSVC assessment: CISA's SSVC record classifies this CVE as exploitation: active, automatable: no, technicalImpact: total. The "not automatable" classification is consistent with the PR:L requirement — authentication is a prerequisite, preventing fully automated exploitation.

Active exploitation: CISA added CVE-2026-45659 to the KEV catalog on 2026-07-01, citing evidence of active exploitation. The SSVC exploitation state changed from none (as of 2026-05-26) to active (as of 2026-07-01). No specific threat actor, campaign, or exploit tooling is named in any source. Attribution of active exploitation to any named actor is unconfirmed — no MITRE ATT&CK actor profile or named group is referenced in the verified reference data or source material. This is a single-sourced claim (CISA KEV listing); while CISA's KEV addition is authoritative, the underlying evidence for active exploitation is not detailed in the provided sources.

Ransomware: The CISA KEV entry states "Known ransomware campaign use: Unknown." No source indicates ransomware involvement. Do not treat this as a ransomware-driven threat.

Discrepancy note: The Hacker News (corpus-1) describes the severity as "important" (Microsoft's severity rating), while the verified NVD/CISA data classifies it as CVSS 8.8 HIGH. Both are consistent — Microsoft uses a four-tier rating (Critical/Important/Moderate/Low) where "Important" maps to the HIGH CVSS band. No factual conflict exists.

4. Mitigation & containment

P1 — Within 24 hours (containment)

• Inventory: Identify all SharePoint Server instances (Subscription Edition, 2019, Enterprise Server 2016) in the estate. Include on-premises and hybrid deployments.
• Internet exposure assessment: Determine which SharePoint instances are internet-exposed. For any internet-exposed instance that cannot be immediately patched, restrict access at the network layer:
• Place SharePoint web front-ends behind VPN or IP-allow-list reverse proxy.
• Block unauthenticated access at the WAF/firewall layer for SharePoint application paths.
• If the SharePoint instance is non-critical, consider temporary decommissioning per CISA KEV guidance: "discontinue use of the product if mitigations are unavailable."
• Credential review: Since exploitation requires valid credentials (PR:L), review and revoke unnecessary SharePoint accounts, especially low-privilege accounts with external or federated access. Audit recent account creations and permission changes.

P2 — Within 72 hours (remediation)

• Apply Microsoft patches: Install the vendor security updates for all affected SharePoint versions. Microsoft released patches (per Help Net Security, corpus-4, dated 2026-05-26). Identify the specific KB article for each SharePoint version and apply.
• Patch sequence: Patch SharePoint farm in standard order: test/staging farm first, then production web front-ends, then application servers, then search/index servers. Run psconfig.exe (SharePoint Products Configuration Wizard) on each server after patch installation.
• Post-patch validation: Confirm SharePoint health analyser shows no critical issues. Verify site collection accessibility and search functionality.

P3 — Within 7 days (hardening & verification)

• Verify remediation: Confirm all SharePoint instances are patched and no vulnerable versions remain. Use vulnerability scanning to validate.
• Harden authentication: Enforce MFA for all SharePoint access. Review federated trust configurations (SAML/OIDC) that may provide authentication paths for low-privilege external users.
• Log review: Review SharePoint USS logs, IIS logs, and Windows Event Logs for signs of exploitation prior to patching (see §5 and §6 for detection guidance).
• Document for DORA/NIS2 compliance: Record the incident classification, remediation timeline, and testing evidence per DORA Art. 17/18/24.

5. Indicators of compromise

No indicators of compromise available in the source material. No specific IOCs (file hashes, domains, IP addresses, mutex names, or exploit artefacts) are provided in any source. CISA's KEV entry confirms active exploitation but does not publish IOCs. This is a confidence caveat: the active exploitation claim is single-sourced (CISA KEV) with no corroborating IOC set. Verify before enforcement.

6. Detection

The sources do not contain specific exploit artefacts, file paths, registry keys, mutex names, or distinctive strings associated with exploitation of CVE-2026-45659. However, the following behavioural detection is authorable from the confirmed technical details:

Sigma rule — detect potential exploitation of CVE-2026-45659 (deserialization RCE on SharePoint)

title: Potential CVE-2026-45659 SharePoint Deserialization RCE
id: 2026-07-02-222-cve-2026-45659
status: experimental
description: >
  Detects suspicious process execution originating from SharePoint Server
  application pools that may indicate exploitation of CVE-2026-45659
  (deserialization of untrusted data leading to RCE). Monitors for unexpected
  child processes spawned by SharePoint IIS worker processes (w3wp.exe) running
  under SharePoint application pool identities.
references:

  - https://nvd.nist.gov/vuln/detail/CVE-2026-45659
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
tags:

  - attack.execution
  - attack.t1059
  - cve.2026.45659
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4688
    NewProcessName:

      - "*\\cmd.exe"
      - "*\\powershell.exe"
      - "*\\pwsh.exe"
      - "*\\csc.exe"
      - "*\\mshta.exe"
      - "*\\wscript.exe"
      - "*\\cscript.exe"
  filter_parent:
    ParentProcessName: "*\\w3wp.exe"
  condition: selection and filter_parent
falsepositives:

  - Legitimate SharePoint administrative scripts or timer jobs spawning processes
  - SharePoint workflow solutions that execute external processes (rare)
level: high

Additional detection guidance (manual)

• Monitor IIS logs for SharePoint application pool requests showing anomalous POST payloads or unusually large request bodies to SharePoint endpoints, particularly those involving serialization/deserialization endpoints.
• Monitor Windows Event Log (Security) for Event ID 4688 (Process Creation) where the parent process is w3wp.exe running under a SharePoint application pool identity (e.g., SP Farm Account, SP App Pool Account) and the child process is an interpreter or shell (cmd.exe, powershell.exe, csc.exe).
• Monitor for unexpected w3wp.exe crashes or restarts of SharePoint application pools, which may indicate failed exploitation attempts.
• Review SharePoint Unified Logging Service (ULS) logs for entries containing deserialization, SerializationException, or TypeLoadException around the time window of suspected exploitation.

YARA rule: Insufficient distinctive strings or file artefacts in the source material to author a meaningful YARA rule. Exploitation of this CVE is network-delivered and does not necessarily produce a file artefact with distinctive strings.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

7. Sources

• NVD — CVE-2026-45659 Detail — https://nvd.nist.gov/vuln/detail/CVE-2026-45659 — Published 2026-06-30, modified 2026-07-02
• CISA — Known Exploited Vulnerabilities Catalog (CVE-2026-45659 entry) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Added 2026-07-01
• The Hacker News — Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions — https://thehackernews.com/2026/05/microsoft-patches-sharepoint-rce-flaw.html — Published 2026-05
• The Hacker News — SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation — https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html — Published 2026-07
• GitHub Security Advisories — GHSA-w3mh-jmwv-56f3: Deserialization of untrusted data in Microsoft Office SharePoint — https://github.com/advisories/GHSA-w3mh-jmwv-56f3 — Published 2026
• Help Net Security — High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659) — https://www.helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659/ — Published 2026-05-26
• BSI Germany (WID-SEC-2026-1764) — Microsoft SharePoint: Schwachheit ermöglicht Codeausführung — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1764 — Published 2026

8. Adverse Trace position

Severity assessment: CVSS 8.8 HIGH (authoritative, NVD-confirmed). CISA KEV-listed with active exploitation as of 2026-07-01. The vulnerability is a low-complexity, authenticated RCE with no user interaction required — a high-value target for initial access brokers and ransomware affiliates, though no ransomware campaign use is confirmed. The PR:L requirement is the primary mitigating factor, but in SharePoint environments with broad low-privilege access (common in financial services), this is a weak barrier. Client-impact assessment: EMEA financial services with internet-exposed SharePoint Server instances (Subscription Edition, 2019, or Enterprise Server 2016) are at immediate risk. The CISA KEV due-date is 2026-07-04 — two days from issuance. Clients should treat this as a P1 remediation. The active exploitation claim is single-sourced (CISA KEV) with no published IOCs or named threat actor; we assess the CISA KEV listing as credible but note the absence of corroborating IOC data. What we will do next: Adverse Trace will monitor for IOC publication, threat actor attribution, and exploit code availability. If IOCs emerge, we will issue a update with detection rules and containment guidance. Clients with confirmed exploitation should notify Adverse Trace immediately for incident response support.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.