SharePoint RCE CVE-2026-45659: Patch Now, CISA Warns

The U.S. Cybersecurity and Infrastructure Security Agency has added a Microsoft SharePoint Server remote code execution flaw to its Known Exploited Vulnerabilities catalog after confirming the bug is under active attack. The vulnerability, tracked as CVE-2026-45659, carries a CVSS score of 8.8 and lets an authenticated attacker run arbitrary code on unpatched on-premises SharePoint servers.

CISA added the flaw to the KEV catalog on July 1, 2026, invoking Binding Operational Directive 26-04 to give Federal Civilian Executive Branch agencies its shortest possible window — three days, with a remediation deadline of July 4. The compressed timeline is a signal in itself: CISA reserves three-day deadlines for vulnerabilities it considers an active, immediate threat.

What the vulnerability is

CVE-2026-45659 is a deserialization of untrusted data bug — the same class of flaw that has repeatedly turned SharePoint into a high-value target. When an application deserializes attacker-controlled data without validating it, the attacker can smuggle in objects that execute code as they are reconstructed. In this case, that means arbitrary code execution in the context of the SharePoint server.

Critically, the barrier to exploitation is low. According to Microsoft, an attacker needs only Site Member permissions — a minimal, commonly granted level of access — and no other elevated privileges. The attack is low-complexity and requires no user interaction, the combination that makes a bug attractive for automated, at-scale exploitation once a working technique is in circulation.

Which versions are affected

Microsoft addressed the flaw in a late-May 2026 out-of-band update covering its three supported on-premises editions. Servers running builds below the following patch levels remain vulnerable:

• SharePoint Server Subscription Edition — versions prior to 16.0.19725.20280
• SharePoint Server 2019 — versions prior to 16.0.10417.20128
• SharePoint Enterprise Server 2016 — versions prior to 16.0.5552.1002

Notably, the fix has been available for roughly five weeks. The gap between the patch’s release in late May and CISA’s confirmation of active exploitation in early July means the organizations most at risk are precisely those that deferred an out-of-band update — and adversaries have had over a month to reverse-engineer the fix and weaponize it.

Who is exploiting it

The active exploitation has been attributed to Storm-2603, a China-based threat actor first identified in 2025 that runs a hybrid operation blending espionage with financially motivated ransomware. The group has previously deployed LockBit Black and the Warlock / X2anylock ransomware families, and it operates a custom command-and-control framework known as ak47c2 with both HTTP and DNS-tunneling variants.

Storm-2603’s tradecraft is well documented from prior campaigns: after gaining initial access through a SharePoint flaw, it plants web shells, harvests credentials with Mimikatz, moves laterally using PsExec and Impacket, and uses “bring your own vulnerable driver” (BYOVD) techniques to disable endpoint defenses before deploying ransomware. That playbook is why CISA’s three-day deadline reads less like compliance paperwork and more like a race — the actor exploiting this bug is one that finishes with encryption.

Echoes of ToolShell

For defenders, this is familiar territory. In July 2025, Storm-2603 was among the actors behind the “ToolShell” campaign, which chained a cluster of SharePoint vulnerabilities — CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771 — to compromise on-premises servers across finance, education, energy, and healthcare in Asia, Europe, and the United States. Reporting at the time indicated that servers belonging to U.S. federal bodies, including the National Nuclear Security Administration and the Department of Education, were caught in the wave.

CVE-2026-45659 is a fresh flaw rather than a ToolShell rerun, but the pattern is the same: on-premises SharePoint remains a soft, internet-adjacent target that sits close to an organization’s identity and file infrastructure, and the same actors keep returning to it.

How to remediate

Applying the update is necessary but not sufficient. Administrators must complete two additional steps on every server in the farm:

1. Install the May 2026 security update to bring the build past the patched version.
2. Run the SharePoint Products Configuration Wizard on each server — the application server first, then each web front-end — to fully apply the fix across the farm.

Skipping the configuration wizard is a common failure mode that leaves servers reporting as patched while remaining exploitable. Organizations running on-premises SharePoint should also review servers for signs of prior compromise — unexpected web shells, new local accounts, or disabled security tooling — given that exploitation predates the KEV listing. Layered controls such as zero-trust segmentation limit how far an attacker can move once inside, and treating this as a potential intrusion rather than a routine patch is the safer posture.

What it means

CVE-2026-45659 is a textbook case of the patch-gap problem: a fix shipped, most defenders moved on, and the ones who didn’t are now the target. The three-day CISA deadline is aimed at federal agencies, but the risk profile — low-privilege RCE, no user interaction, an active ransomware operator — applies to every organization running on-premises SharePoint.

Who is exposed. On-premises deployments, disproportionately concentrated in government, healthcare, education, and manufacturing, bear the brunt. Cloud-hosted SharePoint Online is not affected by this on-prem flaw, which reinforces a broader migration argument even as it offers no comfort to the large installed base that remains on-premises for compliance or latency reasons.

The pattern to internalize. Attackers increasingly weaponize patches faster than defenders deploy them, and they hunt where trust is implicit — inside enterprise collaboration platforms, as with supply-chain compromises that abuse trusted software, or in poisoned proof-of-concept exploit code on GitHub. The defensive lesson is consistency: an out-of-band update is a signal to act, not a suggestion to schedule.

What to watch next. Expect broader scanning and opportunistic exploitation now that the flaw is public and confirmed active, and watch for follow-on ransomware activity from Storm-2603 against organizations that missed the window. The number that will ultimately matter is how many unpatched, internet-facing SharePoint servers remain online in the weeks ahead — historically, that figure declines far more slowly than the severity warrants.