U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Microsoft SharePoint Server flaw to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft SharePoint Server flaw, tracked as CVE-2026-45659 (CVSS score v3.1 of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog.
At the end of May, Microsoft released security updates to patch the high-severity SharePoint vulnerability CVE-2026-45659 that could allow remote code execution. The flaw does not require complex conditions for exploitation, making it a serious risk for unpatched systems. Organizations using Microsoft SharePoint should apply the updates as soon as possible.
The root cause is deserialization of untrusted data.
“Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.” reads the advisory. “In a network-based attack, an authenticated attacker, who has a minimum of Site Member permissions (PR:L), could execute code remotely on the SharePoint Server.”
Deserialization of untrusted data is a security vulnerability that happens when an application accepts and processes serialized data from an untrusted source without proper validation. An attacker can craft a payload that runs code on the server. In this case, all it takes is network access and a low-privilege SharePoint account.
The vulnerability was discovered and reported by a researcher using the moniker MEOW. Patches are available for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. If you’re running any of these, the update is out and there’s no good reason to wait.
Apply the fix now, not after the next Patch Tuesday retrospective.
At the time, Microsoft said exploitation is less likely for this particular flaw, but that assessment deserves some skepticism.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerability by the end of this week, on July 4, 2026.
SharePoint has a long and well-documented history of being targeted. In April, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Microsoft SharePoint Server flaw CVE-2026-32201 to its Known Exploited Vulnerabilities (KEV) catalog.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
