Analysis
CVE-2026-45659 is a deserialization-of-untrusted-data vulnerability in Microsoft SharePoint Server that lets an authenticated attacker execute code over the network. It carries a CVSS score of 8.8. What moves it from "another Patch Tuesday item" to "drop everything" is timing: CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on July 1, 2026, with a federal remediation deadline of July 4, 2026 — a 72-hour clock — on a bug Microsoft had already patched back in May.
What we know
- 2026-05-21 — Microsoft ships fixes for the SharePoint deserialization cluster, including CVE-2026-45659 and its sibling CVE-2026-47294, in out-of-band and regular updates. Subscription Edition fix lands in build
16.0.19725.20280. - 2026-07-01 — CISA adds CVE-2026-45659 to the KEV catalog citing evidence of active exploitation, and sets the remediation due date to 2026-07-04.
- 2026-07-02/03 — Tier-1 outlets (The Hacker News, Security Affairs) report the KEV addition and confirm the ~6-week gap between patch availability and observed exploitation.
Source-layer flag: the "active exploitation" determination is CISA's (KEV inclusion criteria) and is reported via tier-1 press; we have not independently verified exploitation against captured payload artifacts. The CVSS, affected builds, and patch details are from vendor advisory reporting.
Technical analysis
The vulnerability is a classic .NET deserialization sink: SharePoint accepts serialized data and reconstructs objects from it without sufficiently validating the type graph, allowing an attacker to craft a payload that executes code during deserialization. The critical nuance for risk-rating is the privilege bar — per vendor reporting, exploitation requires only Site Member permissions, the lowest meaningful authenticated tier in a SharePoint site. In most enterprise deployments, "authenticated with Site Member" describes a very large population: employees, contractors, and — where SharePoint is externally reachable — anyone who has obtained or been granted a low-privilege account.
Source-layer flag: the Site Member privilege requirement and the deserialization mechanism are reported from vendor advisory summaries, not independently verified against an exploit sample.
Treat "authenticated-only" as a weak mitigation here. A CVSS 8.8 RCE that a Site Member can trigger, on a product routinely exposed to the internet and to broad internal user populations, is functionally close to unauthenticated for a determined attacker who can phish or purchase one low-tier credential.
Indicators of compromise
Patched build (Subscription Edition): 16.0.19725.20280 or later. SharePoint 2019 and Enterprise 2016 have equivalent fixes from the same 2026-05-21 release.
Sibling vulnerability to patch in the same pass: CVE-2026-47294 (companion SharePoint deserialization flaw fixed in the same build; not independently KEV-listed as of 2026-07-03).
No public network IOCs (C2 IPs, file hashes) were available in tier-1 reporting as of 2026-07-03. Post-exploitation behavior is actor-defined. Hunt on behavior, not indicators (see Detection).
Detection and mitigation
- Patch first. Confirm every SharePoint farm — Subscription Edition, 2019, Enterprise 2016 — is on the 2026-05-21 build or later. The federal KEV deadline is 2026-07-04; treat that as your internal deadline regardless of sector.
- Hunt the web tier for RCE artifacts: anomalous child processes spawned by the SharePoint IIS worker (
w3wp.exe) —cmd.exe,powershell.exe,csc.exe— especially where the parent request came from a Site Member-tier account. - Look for freshly written files in SharePoint web-accessible paths (
_layouts,_vti_bin, LAYOUTS/TEMPLATE directories) — a common webshell drop location after SharePoint RCE. - Review authentication logs for low-privilege accounts performing unusual POST activity to SharePoint endpoints immediately before any of the above.
- Reduce exposure: if a farm does not need to be internet-facing, remove the public reachability. Front any required external access with an authenticating proxy.
Attribution
No threat actor is publicly attributed to CVE-2026-45659 exploitation as of 2026-07-03. CISA's KEV inclusion asserts exploitation but does not name an operator, and no vendor report reviewed makes an attribution claim. Confidence in any actor assignment is therefore unknown. What is claimed: active exploitation exists (CISA). What is not claimed: who, at what scale, or with what post-exploitation objective. This would change if a vendor publishes an incident writeup with C2 or tradecraft linking the activity to a known cluster.
Criminal-market signal
Bounded negative (evidenced): on 2026-07-03 we swept ~25 dark-web search engines over Tor for CVE-2026-45659 and the patch build 16.0.19725.20280. Of ~200 pages crawled, the L3 relevance filter flagged 28 as candidate-relevant; manual review classified all 28 as noise — dark-web news mirrors, directory/webring pages, and generic Office-exploit-builder ads (e.g. "Silent Word Exploit") that surface for any CVE query — with no page listing a working CVE-2026-45659 exploit for sale. No criminal-market listing was found on the venues our pipeline can see (closed forums and Telegram are out of scope). On the exploit-availability axis, the relevant signal is the KEV listing itself: CISA's "known exploited" bar means a working technique is in use in the wild, which historically precedes broader commodity exploit-kit circulation for high-value enterprise targets like SharePoint by days to weeks. SharePoint RCEs have a strong track record of crossing from targeted use to mass scanning quickly; the 6-week patch-to-KEV gap indicates defenders, not attackers, are behind.
CISO translation
A serious flaw in Microsoft SharePoint lets a user with even minimal access run their own commands on the server, and attackers are already using it. If we run SharePoint anywhere — especially internet-facing — this is an immediate exposure, because "minimal access" covers most of our staff and contractors and any external account. Patch every SharePoint server to the May 2026 update by July 4 and run a compromise hunt on those servers this week. Confidence is high that this is real and urgent: it is on CISA's actively-exploited list with a hard federal deadline; the only open question is whether we have already been hit, which the hunt answers. The cost of inaction is a full web-tier server takeover — data theft, ransomware staging, or a foothold into the internal network — on a system that usually holds sensitive documents.