CVE-2026-45659 – SharePoint Server deserialization flaw – what it means and how to fix it

What breaks and who should care

If your environment runs Microsoft SharePoint Server, the vulnerability identified as CVE-2026-45659 is now a real risk. An attacker who can authenticate to the SharePoint farm could send specially crafted data that the server will deserialize. The result is remote code execution over the network. This is not a theoretical flaw – it has been confirmed in the wild and is being used by ransomware operators. Anyone responsible for a SharePoint deployment should treat this as a high‑priority issue.

Related remediation guides

Other vulnerabilities in the same family or affecting the same products:

• CVE-2025-53770 SharePoint Server – Immediate Action Guide
• Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation
• CVE-2025-59528 – Immediate steps for Flowise remote code execution

For the wider picture, our Known Exploited Vulnerabilities tracker lists every flaw CISA has confirmed under active attack.

Why the vulnerability matters

The CVSS score of 8.8 places this flaw squarely in the high severity band. An authorised attacker can take control of the server process, run arbitrary commands, and potentially move laterally across the corporate network. Because the attack works over the network, it does not require local access or physical presence. The impact is therefore broad: confidentiality, integrity and availability of all data stored in SharePoint are at stake.

Technical background

The NVD description classifies CVE-2026-45659 as a deserialization of untrusted data issue. In plain terms, SharePoint takes data supplied by a client, turns it into an object in memory, and then uses that object to perform actions. If the data is crafted in a way that the deserialization routine does not validate, the attacker can inject objects that execute code when the server processes them. The exact code paths and payload formats have not been publicly disclosed, but the class of flaw is well understood: unsafe handling of serialized objects.

How the attack works

First, the attacker must have a valid SharePoint account – the vulnerability is not unauthenticated. Once inside, the attacker sends a request that contains a malicious payload embedded in a field that SharePoint expects to deserialize. The server reads the payload, creates objects from it, and because the deserialization routine does not enforce a strict type whitelist, the malicious objects run code with the privileges of the SharePoint service account. That code can download additional malware, create new user accounts, or exfiltrate data. Because the service account often has wide permissions, the attacker can quickly expand their foothold.

Evidence of exploitation

CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalog on 1 July 2026. The agency also records that ransomware groups have incorporated this flaw into their attack kits. This means that if you see unusual outbound traffic from a SharePoint server, or a sudden spike in privileged account creation, the vulnerability could be the cause.

Determining whether you are affected

SharePoint Server is the only product listed as vulnerable. The NVD table below shows the range of builds that are vulnerable and the point at which Microsoft released a fix. To know if your farm falls in that range, you need to query the current build version. The most reliable method is to run PowerShell on the SharePoint server:

• Get-SPFarm | Select-Object BuildVersion

This command returns the exact build identifier that the server is running. Compare that identifier with the entries in the table below. If your build appears in the vulnerable range, you are exposed.

Immediate mitigations

CISA’s guidance for this vulnerability is clear: apply the vendor‑supplied mitigations as soon as possible. The recommended action is to upgrade the SharePoint farm to the patched release for your branch. Microsoft has published a security update that resolves the deserialization flaw. Applying that update brings the build version out of the vulnerable range.

Step‑by‑step upgrade

• Back up the SharePoint farm configuration and content databases.
• Download the latest cumulative update for SharePoint Server from the Microsoft Update Catalog.
• Run the installer on each server in the farm, following the on‑screen prompts.
• After installation, run the SharePoint Products Configuration Wizard to complete the upgrade.
• Verify the build version again with Get-SPFarm | Select-Object BuildVersion to ensure the patch applied.

Do not skip the configuration wizard – it finalises the schema changes required by the security update.

Alternative mitigations if you cannot patch immediately

In some environments a full upgrade may be delayed by change‑management windows or dependencies on third‑party solutions. In those cases, you should implement defence‑in‑depth measures while you plan the upgrade.

• Restrict network access to the SharePoint web front ends. Only allow traffic from known internal subnets and trusted VPN endpoints.
• Enforce multi‑factor authentication for all SharePoint accounts, reducing the chance that an attacker can obtain a valid credential.
• Deploy a web‑application firewall (WAF) that can block suspicious payloads. Look for signatures that match known deserialization exploit patterns.
• Disable any custom web services or API endpoints that are not required for business operations.
• Monitor the SharePoint logs for unusual deserialization errors or spikes in authentication failures.

These steps do not replace the patch, but they raise the bar for an attacker and buy you time.

Compliance with CISA directives

CISA requires organisations to apply mitigations in line with BOD 26‑04, which prioritises security updates based on risk. Because CVE-2026-45659 carries a high CVSS score and is known to be used in ransomware, it falls squarely into the high‑risk category. Your remediation plan should therefore be documented as a priority‑one action in any risk‑based patch‑management programme.

The agency also mentions “Forensics Triage Requirements”. After you apply the patch, run a baseline collection of logs and system images. This will help you prove that the environment was not compromised before the fix and will aid any later forensic investigation.

What to do after patching

Once the patched build is in place, verify that the vulnerability is no longer present. Run the same PowerShell command to confirm the build version. Then, conduct a short penetration test focused on SharePoint’s deserialization paths – either internally or via a trusted third‑party service. If the test shows no exploitable behaviour, you can consider the immediate risk mitigated.

Finally, update your incident‑response playbooks. Add a step that checks for this specific CVE during regular vulnerability scans, and ensure the scan rules flag any server that still reports the vulnerable build.

Summary checklist

• Identify SharePoint servers in your environment.
• Run Get-SPFarm | Select-Object BuildVersion on each server.
• Compare the returned build against the table below.
• If vulnerable, back up the farm and apply the latest cumulative update.
• Run the configuration wizard and verify the new build version.
• If you cannot patch immediately, restrict network access, enforce MFA, enable a WAF, and monitor logs.
• Document the remediation in line with CISA BOD 26‑04 and Forensics Triage guidance.
• Retest after patching to confirm the issue is resolved.

Version table

Refer to the table below for the exact range of vulnerable and fixed builds. The table is generated automatically from the NVD data and will always stay in sync with the official source.

Affected versions

Straight from the NVD record for CVE-2026-45659. If your build is inside one of these ranges, treat it as vulnerable.

Product	Affected range	Fixed in
sharepoint_server	* up to 16.0.19725.20280	16.0.19725.20280