CVE-2026-45659
Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
Description
CVE-2026-45659 is a HIGH-severity deserialization of untrusted data vulnerability in Microsoft Office SharePoint Server, carrying a CVSS 3.1 score of 8.8. The flaw lets an authorized attacker send a maliciously crafted serialized object over the network that SharePoint reconstructs without sufficient validation, resulting in remote code execution on the server. Because SharePoint often holds sensitive corporate documents and integrates with Active Directory, exploitation of this deserialization vulnerability can lead to full compromise of the affected host and lateral movement across the environment. CVE-2026-45659 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2026-07-04, and its EPSS score of 0.03219 (86.7th percentile) reflects meaningfully elevated exploitation likelihood, making prompt patching of SharePoint essential.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | sharepoint server | < 16.0.19725.20280; 2016; 2019 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45659(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2026-45659 stems from CWE-502, where Microsoft SharePoint Server deserializes attacker-supplied data without verifying that the resulting objects are valid and safe. Because SharePoint reconstructs objects from a serialized format the attacker controls, an authenticated user can craft input that instantiates arbitrary objects and triggers dangerous operations — the classic path from a deserialization vulnerability to remote code execution.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2026-45659 carries a CVSS 3.1 score of 8.8 (HIGH) and is remotely exploitable without physical access (Attack Vector NETWORK), easy to exploit with no special conditions (Attack Complexity LOW), and requires no user interaction, though the attacker must hold low-level privileges on the SharePoint instance. A successful exploit yields HIGH impact to confidentiality, integrity, and availability: the attacker can read the sensitive documents and credentials stored in SharePoint, tamper with or destroy content and system files, and disrupt availability of the collaboration platform. Although the scope is Unchanged — keeping the direct impact within the SharePoint component — code execution on a SharePoint server frequently serves as a foothold for wider network compromise. With an EPSS score in the 86.7th percentile and confirmed active exploitation via the KEV listing, organizations running affected SharePoint versions should treat this vulnerability as an urgent priority.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-45659 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 2026-07-04. The KEV ransomware status is currently listed as Unknown, but SharePoint remote-code-execution flaws are historically attractive to a broad range of threat actors, from initial-access brokers to ransomware operators. The EPSS score of 0.03219 places CVE-2026-45659 in the 86.7th percentile, indicating exploitation is considerably more likely than for the average CVE. No public proof-of-concept is tagged in the available references, but the KEV listing means working exploit tooling is already in use — organizations should act on the assumption that attacks are ongoing and patch immediately.
Remediation
- Apply the vendor security update. Per CISA's KEV required action, apply mitigations in accordance with Microsoft's instructions and follow BOD 26-04 patching guidance; if fixes are unavailable, discontinue use of the exposed product. Consult the MSRC advisory at msrc.microsoft.com for the specific update.
- Upgrade to a fixed build. Update on-premises SharePoint Server (2016 and 2019 are affected) to build 16.0.19725.20280 or later, which remediates the deserialization flaw.
- Restrict and segment network access. Limit access to SharePoint to trusted networks and authenticated users only, and place the servers behind a reverse proxy or WAF that can inspect and block hostile serialized payloads while patching is scheduled.
- Hunt for prior exploitation. Review IIS and SharePoint ULS logs for anomalous requests and unexpected process creation (e.g., w3wp.exe spawning cmd.exe/PowerShell), and check for newly created web shells or files, given confirmed in-the-wild exploitation.
- Harden deserialization long-term. Where configurable, enforce allowlists that restrict which types may be deserialized and add integrity checks (HMAC/signatures) on serialized data so untrusted objects are rejected before reconstruction.
Technical Details
CVE-2026-45659 is a deserialization vulnerability in Microsoft Office SharePoint Server that is triggered when the application reconstructs objects from a serialized payload supplied by an authenticated network client. Serialization converts objects into a transportable format and deserialization rebuilds them; because SharePoint does not sufficiently verify the incoming data, an attacker who controls the serialized stream can force instantiation of arbitrary objects and invoke gadget chains that execute code during the deserialization process. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H shows the attack is network-borne, low-complexity, requires only low privileges, and needs no user interaction, which is why it achieves full HIGH impact across confidentiality, integrity, and availability with Unchanged scope. This class of flaw (CWE-502) is among the most severe in enterprise software precisely because it turns a data-handling routine into an arbitrary-code-execution primitive.
Frequently Asked Questions
Is CVE-2026-45659 being actively exploited?
Yes. CVE-2026-45659 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, with a remediation deadline of 2026-07-04. Its EPSS score of 0.03219 (86.7th percentile) further indicates elevated exploitation likelihood. Ransomware involvement is currently listed as Unknown.
What products are affected by CVE-2026-45659?
The vulnerability affects Microsoft SharePoint Server, specifically SharePoint Server 2016 and 2019 and builds prior to 16.0.19725.20280. Organizations running on-premises SharePoint should verify their build number and prioritize updating. Cloud-hosted SharePoint Online is managed by Microsoft.
How do I fix CVE-2026-45659?
Apply Microsoft's security update per the MSRC advisory and upgrade affected SharePoint servers to build 16.0.19725.20280 or later. While patching, restrict network access to trusted users, deploy WAF/reverse-proxy filtering, and review logs for signs of prior compromise as described in the Remediation section.
How severe is CVE-2026-45659?
CVE-2026-45659 is rated HIGH with a CVSS 3.1 score of 8.8. It permits remote code execution with only low privileges and no user interaction, achieving HIGH impact to confidentiality, integrity, and availability. Its inclusion in the KEV catalog and 86.7th-percentile EPSS score make it a high-priority vulnerability for immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.