Full Report
CISA confirmed today that ransomware gangs have begun abusing a high-severity Microsoft SharePoint remote code execution vulnerability, which has been flagged as actively exploited since early July. [...]
Analysis Summary
# Vulnerability: Microsoft SharePoint Remote Code Execution via Deserialization
## CVE Details
- **CVE ID:** CVE-2026-45659
- **CVSS Score:** High (Specific numerical score not provided in text, but categorized as "High-severity")
- **CWE:** CWE-502 (Deserialization of Untrusted Data)
## Affected Systems
- **Products:** Microsoft SharePoint Server
- **Versions:**
- SharePoint Enterprise Server 2016
- SharePoint Server 2019
- SharePoint Server Subscription Edition
- **Configurations:** Systems where "Site Owner" or higher permissions (low privileges) are accessible to an attacker.
## Vulnerability Description
The flaw exists due to the insecure deserialization of untrusted data within Microsoft SharePoint. Deserialization is the process of turning data back into an object; if the application does not properly validate the incoming data, an attacker can craft a malicious payload that triggers arbitrary code execution during the reconstruction process. This allows a remote attacker with low-level privileges to execute commands in the context of the SharePoint server.
## Exploitation
- **Status:** **Exploited in the wild.** Flagged by CISA as actively abused by ransomware gangs since early July.
- **Complexity:** Low (Repeatable success achievable without significant prior system knowledge).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Full access to data and potential lateral movement).
- **Integrity:** High (Ability to execute arbitrary code and modify system files).
- **Availability:** High (Potential for ransomware to encrypt files or crash services).
## Remediation
### Patches
Microsoft released security updates for this vulnerability in May 2026. Admins should apply the latest cumulative updates for:
- SharePoint Enterprise Server 2016
- SharePoint Server 2019
- SharePoint Server Subscription Edition
### Workarounds
No specific configuration workarounds were provided in the article; immediate patching is the primary recommended action.
## Detection
- **Indicators of Compromise:** Monitor for unusual child processes spawning from SharePoint web worker processes (e.g., `w3wp.exe` spawning `cmd.exe` or `powershell.exe`).
- **Detection methods and tools:**
- Enable **Windows Antimalware Scan Interface (AMSI)** integration for SharePoint web applications.
- Utilize **Microsoft Defender Antivirus (MDAV)** for automated detection and remediation of known exploit payloads.
- Check Shadowserver or similar external attack surface management tools to see if local IP addresses are flagged as unpatched.
## References
- **CISA KEV Catalog:** hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- **Vendor Advisory:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-45659
- **Shadowserver Statistics:** hxxps[://]dashboard[.]shadowserver[.]org/statistics/iot-devices/time-series/
- **BleepingComputer Report:** hxxps[://]www[.]bleepingcomputer[.]com/news/security/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks/