SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation

1. Executive summary

CISA added CVE-2026-45659 (CVSS 8.8, HIGH) to its Known Exploited Vulnerabilities (KEV) catalog on 2026-07-01, citing evidence of active exploitation. The vulnerability is a deserialization-of-untrusted-data flaw (CWE-502) in Microsoft SharePoint Server that permits an authenticated attacker with Site Member permissions to execute code remotely over a network. Affected products include SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016; Microsoft released patches in May 2026. EMEA financial services running on-premises SharePoint should treat this as a priority remediation item — the low attack complexity (AC:L) and low privileges required (PR:L) mean any compromised or low-privilege account becomes a launch point for RCE against core collaboration infrastructure.

2. Regulatory framing

3. Technical analysis & attack chain

Vulnerability details

• CVE: CVE-2026-45659
• CVSS: 8.8 (HIGH) — per NVD/CISA KEV
• CWE: CWE-502 (Deserialization of Untrusted Data)
• Affected products: Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, SharePoint Enterprise Server 2016
• Prerequisites: Authenticated attacker with minimum Site Member permissions (PR:L); no admin or elevated privileges required; no user interaction required
• Attack complexity: Low (AC:L)
• Vector: Network-based
• Microsoft exploitation assessment: "Exploitation Less Likely" (noted in Microsoft's advisory; CISA nonetheless cites evidence of active exploitation)
• Patch availability: Microsoft released fixes in May 2026
• CISA KEV addition date: 2026-07-01
• CISA KEV remediation due date (FCEB agencies): 2026-07-04
• Known ransomware campaign use (per CISA KEV): Unknown

Confirmed attack chain

1. Reconnaissance / target identification. The attacker identifies an internet-exposed or network-accessible SharePoint Server instance running one of the affected versions (Subscription Edition, 2019, or Enterprise Server 2016).
2. Authentication. The attacker authenticates with a low-privilege account — Site Member permissions (PR:L) are sufficient. No admin or elevated privileges are required. This means any standard collaborator account, compromised credential, or default account provides a sufficient foothold.
3. Expit exploitation. The attacker sends a crafted request to the SharePoint Server that triggers deserialization of untrusted data. Because the server does not properly validate or restrict the deserialized object, the attacker's payload executes code in the context of the SharePoint Server process.
4. Remote code execution. Arbitrary code executes on the SharePoint Server host. The attacker achieves RCE without any user interaction (UI:N) and with low attack complexity (AC:L).

What is NOT confirmed

• The specific exploitation path CISA observed (i.e., who is exploiting it, how, and to what end) is not publicly known. The Hacker News article states: "It's currently not known how the vulnerability is being exploited, who is behind the activity, and what the end goals of these efforts are."
• No specific IOCs (IPs, domains, hashes, file names, or command-line artefacts) have been published in connection with the active exploitation of CVE-2026-45659.
• No MITRE ATT&CK actor profile is referenced in the verified reference data for any actor associated with this CVE's exploitation. Attribution is unconfirmed.

Adjacent threat context (single-sourced; verify before enforcement)

The primary source article includes a section describing Microsoft's discovery of two parallel threat clusters during a routine ransomware investigation. This activity is attributed to a threat actor designated "Storm-2603," described as deploying "Warlock ransomware" by exploiting known vulnerabilities in on-premises SharePoint servers since mid-2025. However, the article does not state that Storm-2603 is exploiting CVE-2026-45659 specifically. The initial access vector in that investigation is attributed to a separate vulnerability — CVE-2025-11371 (CVSS 9.1), a critical flaw in Gladinet Triofox. The Storm-2603 activity is therefore adjacent context, not a confirmed exploitation path for CVE-2026-45659. Attribution to Storm-2603 is single-sourced (Microsoft Incident Response via The Hacker News); no MITRE ATT&CK profile for Storm-2603 is present in the verified reference data, so the attribution is treated as unconfirmed.

Technical details from the Storm-2603 investigation (for context only — not confirmed as related to CVE-2026-45659 exploitation):

• Initial access probing: Requests for files including win.ini and web.config, indicating local file inclusion probing.
• Tools deployed: "Velociraptor" — described as a tool used to blend malicious activity with trusted administrative behaviour.
• Remote access channels: Cloudflare tunneling, Zoho Assist, and SSH connections configured through Visual Studio Code.
• Privilege escalation: Creation of new local and domain administrator accounts.
• Driver-based defence evasion: A vulnerable driver (NSecKrnl.sys) was used to tamper with endpoint security protections and reduce their visibility.
• Second threat actor: A separate, unrelated actor was discovered in the same environment using DLL side-loading and custom backdoors.
• Lateral movement: The attackers moved laterally beyond the first network into a second organisation, confirmed compromised by the same Storm-2603 ransomware activity.

Confidence caveat: The Storm-2603 / Warlock ransomware details are single-sourced (Microsoft Incident Response, reported via The Hacker News). They are not linked to CVE-2026-45659 exploitation in the source material. Do not treat them as IOCs for this CVE without independent verification.

4. Mitigation & containment

P1 — Within 24 hours: Identify and contain

1. Inventory. Identify all SharePoint Server instances in the estate — on-premises and any internet-exposed. Focus on: - SharePoint Server Subscription Edition - SharePoint Server 2019 - SharePoint Enterprise Server 2016
2. Assess exposure. For each instance, determine: - Is it internet-exposed? (check reverse proxy, WAF, firewall rules) - What authentication boundary is in place? (any internet-exposed SharePoint with standard Site Member accounts accessible is high-risk) - Are there service accounts or low-privilege accounts that could be leveraged by an attacker?
3. Containment. If an instance is internet-exposed and cannot be immediately patched: - Restrict access at the network layer (firewall, reverse proxy ACLs) to trusted IP ranges only. - Enforce MFA for all SharePoint authentication paths. - Monitor for anomalous authenticated requests, particularly any that exhibit deserialization payload patterns or unusual POST body sizes to SharePoint endpoints. - If the instance is non-business-critical, consider temporary decommissioning until patched.

P2 — Within 72 hours: Patch

1. Apply Microsoft's May 2026 patches to all affected SharePoint Server instances. The patches were released in May 2026; ensure the specific update package for your SharePoint version is identified and applied.
2. Test before deployment in production where feasible — but given active exploitation and the CISA KEV listing, prioritise patching over extended testing windows. DORA Art. 24 (digital operational resilience testing) supports post-patch functional validation.
3. Verify patch application. Confirm the installed version matches or exceeds the patched version for each SharePoint edition.

P3 — Within 7 days: Harden and verify

1. Review authentication. Audit Site Member-level accounts across all SharePoint instances. Remove unused accounts, enforce least privilege, and ensure no default or service accounts retain unnecessary SharePoint access.
2. EDR / monitoring. Ensure endpoint detection and response (EDR) or equivalent monitoring covers all SharePoint Server hosts. Post-patch, monitor for: - Unexpected process spawning from the SharePoint application pool worker process (e.g., w3wp.exe). - New local or domain administrator account creation. - Unusual outbound connections (Cloudflare tunneling, Zoho Assist, SSH from non-admin workstations). - DLL side-loading indicators (unexpected DLLs loaded by SharePoint or related processes).
3. Internet exposure reduction. If any SharePoint instance remains internet-exposed after patching, document a business justification and ensure it is behind a WAF or reverse proxy with appropriate rules.
4. CISA KEV compliance. The CISA KEV due date for FCEB agencies is 2026-07-04. While this applies to U.S. federal agencies, EMEA financial services should treat this as a benchmark and aim to complete remediation by or before this date.

5. Indicators of compromise

No indicators of compromise are available in the source material for CVE-2026-45659 exploitation specifically.

The source material describes artefacts from the adjacent Storm-2603 investigation (CVE-2025-11371 / Gladinet Triofox initial access), but these are not confirmed IOCs for CVE-2026-45659 and are single-sourced. They are listed below for reference only with explicit caveats.

Confidence caveat: These artefacts are single-sourced (Microsoft Incident Response, reported via The Hacker News) and are associated with Storm-2603 / CVE-2025-11371 activity, not confirmed CVE-2026-45659 exploitation. Verify before enforcement. They are not suitable as standalone detection signatures for CVE-2026-45659.

Because no confirmed IOCs for CVE-2026-45659 exist in the source material, no copyable IOC block is provided.

6. Detection

The source material contains artefacts from the adjacent Storm-2603 investigation. While these are not confirmed IOCs for CVE-2026-45659, they are distinctive strings suitable for a YARA rule to detect the described tooling if it appears in a SharePoint-related incident response context. The rule below targets the Storm-2603 tooling artefacts only.

rule Storm_2603_SharePoint_Adjacent_Artefacts {
    meta:
        author = "Adverse Trace"
        date = "2026-07-02"
        reference = "https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html"
        description = "Detection of Storm-2603 adjacent tooling artefacts (Velociraptor, NSecKrnl.sys) — NOT confirmed IOCs for CVE-2026-45659. Single-sourced; verify before enforcement."
    strings:
        $tool_velociraptor = "Velociraptor" nocase
        $driver_nseckrnl = "NSecKrnl.sys" nocase
        $file_winini = "win.ini" nocase
        $file_webconfig = "web.config" nocase
        $ra_cloudflare = "Cloudflare tunneling" nocase
        $ra_zoho = "Zoho Assist" nocase
        $ra_vscode_ssh = "Visual Studio Code" nocase
    condition:
        2 of them
}

title: Suspicious Remote Access Tool Installation on SharePoint Server Host
id: AT-2026-07-02-218-sigma-1
status: experimental
description: >
    Detects installation or execution of remote-access tools (Zoho Assist, Cloudflare tunnel client)
    on hosts running Microsoft SharePoint Server. Based on Storm-2603 TTPs reported by Microsoft
    Incident Response via The Hacker News. NOT confirmed for CVE-2026-45659 exploitation.
    Single-sourced; verify before enforcement.
references:

    - https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html
author: Adverse Trace
date: 2026/07/02
logsource:
    product: windows
    service: process_creation
detection:
    selection_tools:
        Image|contains:

            - "zoho"
            - "cloudflared"
            - "code.exe"
    filter_legitimate:
        Image|contains:

            - "C:\\Program Files\\Microsoft VS Code\\"
    condition: selection_tools and not filter_legitimate
falsepositives:

    - Legitimate administrative use of VS Code, Zoho Assist, or Cloudflare tunneling on SharePoint hosts
level: medium

title: New Local or Domain Administrator Account Creation on SharePoint Host
id: AT-2026-07-02-218-sigma-2
status: experimental
description: >
    Detects creation of new local or domain administrator accounts — a privilege-escalation
    technique associated with Storm-2603 activity reported by Microsoft Incident Response.
    NOT confirmed for CVE-2026-45659 exploitation. Single-sourced; verify before enforcement.
references:

    - https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html
author: Adverse Trace
date: 2026/07/02
logsource:
    product: windows
    service: security
detection:
    selection_event:
        EventID:

            - 4720  # User account created
            - 4728  # Domain user account added to global group
            - 4732  # Local user account added to local group
            - 4752  # Domain user account added to global group (DC)
    selection_admin_group:
        TargetAccountName|contains:

            - "Administrators"
            - "Domain Admins"
    condition: selection_event
falsepositives:

    - Legitimate administrator account creation during provisioning
level: medium

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

7. Sources

• The Hacker News — "SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation" — https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html — 2026-07-02
• The Hacker News — "Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions" — https://thehackernews.com/2026/05/microsoft-patches-sharepoint-rce-flaw.html — 2026-05
• CISA / NVD — "CVE-2026-45659 — Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability" — https://nvd.nist.gov/vuln/detail/CVE-2026-45659 — accessed 2026-07-02
• Help Net Security — "High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659)" — https://www.helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659/ — 2026-05-26

8. Adverse Trace position

Severity assessment: CVE-2026-45659 is CVSS 8.8 HIGH, CISA KEV-listed with confirmed active exploitation, and affects three widely deployed SharePoint Server editions. The low attack complexity (AC:L) and low privilege requirement (Site Member, PR:L) make this exploitable by any authenticated low-privilege user — a significantly lower bar than typical RCE vulnerabilities. We assess this as a high-priority remediation item for any EMEA financial services entity running on-premises SharePoint Server.

Client-impact assessment: Entities with internet-exposed SharePoint instances are at highest risk. Entities with internally-only SharePoint should still prioritise patching given the low privilege threshold for exploitation — any compromised standard account becomes a vector. The CISA KEV remediation due date of 2026-07-04 (for FCEB agencies) provides a useful benchmark; we recommend EMEA clients target the same or sooner.

What we will do next: Adverse Trace will monitor for (a) publication of specific IOCs or exploitation details for CVE-2026-45659, (b) any confirmed link between the Storm-2603 / Warlock ransomware activity and this CVE, and (c) any additional CISA or vendor guidance. If confirmed IOCs emerge, we will issue a follow-up with updated detection rules. Clients with identified vulnerable SharePoint instances should notify their Adverse Trace account team for tailored remediation support.

Confidence note: The exploitation details for CVE-2026-45659 remain unconfirmed — CISA cites active exploitation but the specific actor, method, and objectives are not publicly known. The Storm-2603 / Warlock ransomware context is single-sourced and associated with a different CVE (CVE-2025-11371). Attribution to Storm-2603 is unconfirmed (no MITRE ATT&CK profile in verified reference data). Clients should treat the Storm-2603 details as threat-intelligence context, not as confirmed indicators for this CVE.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.