CVE-2026-45659
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Jul 1, 2026
- US federal agencies must remediate it by Jul 4, 2026 (BOD 22-01)
- First attack observed 39 days after disclosure
- Used in ransomware campaigns
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Aug 20, 2026 Aug 7, 2026 Jul 18, 2026 Jul 16, 2026 Jul 14, 2026 Jul 1, 2026
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| microsoft | sharepoint server | < 16.0.19725.20280 |
Related articles
RansomwareSharePoint: CISA Confirms Ransomware Exploitation of CVE-2026-45659
CISA confirms ransomware exploitation of SharePoint CVE-2026-45659 vulnerability. Patch servers and enable AMSI to prevent code execution and network breaches.
VulnerabilitiesSharePoint: Proof of Concept for Critical Flaw Already Used in Attacks
Critical SharePoint CVE-2026-55040 allows impersonation via JWT bypass. PoC exploited in attacks. Patched July 2026. Secure exposed servers.
VulnerabilitiesFour Critical Vulnerabilities Exploited Against macOS, SharePoint, VMware vCenter, and Windows
CISA has added four actively exploited critical vulnerabilities to its Known Exploited Vulnerabilities KEV catalog. The flaws affect Apple macOS,
VulnerabilitiesCVE-2026-69836: Critical Vulnerability Exploited in Microsoft Entra ID, but Customers Need Take No Action
Microsoft fixes critical CVE-2026-69836 in Entra ID, fully mitigated. No patches needed. Exploited in attacks but resolved.
VulnerabilitiesBTR Reforged: Microsoft Defender’s Driver Can Be Weaponized Against Windows Security
BTR Reforged: Abusing Defender's driver to bypass Windows security. Requires admin access, affects Windows 7-11. Presented at Black Hat 2026.
VulnerabilitiesMicrosoft Fixes 398 Vulnerabilities as Exploited Windows Kernel Flaw Enters CISA KEV
Microsoft patched 398 vulnerabilities, including exploited Windows kernel flaw CVE-2026-68820 now in CISA KEV. Patch immediately.
This product uses the NVD API but is not endorsed or certified by the NVD.