{"id":"sharepoint-deserialization-cve-2026-45659-jul-2026","category":"patch","status":"closed","title":"Microsoft SharePoint Server code-execution flaw CVE-2026-45659 used in attacks, including by ransomware gangs","tldr":"Attackers, including ransomware gangs, are using CVE-2026-45659 in on-premises SharePoint Server (2016, 2019, Subscription Edition). Microsoft fixed it in May 2026. If you run SharePoint yourself, confirm the May 2026 updates are installed.","summary":"CVE-2026-45659 is a deserialization flaw in on-premises Microsoft SharePoint Server. An attacker who has a low-privilege account on the server can send it crafted data over the network and run their own code on it. It affects SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Enterprise Server 2016. Microsoft fixed it in its May 2026 updates, but the advisory initially left the CVE out of the May update notes. Microsoft corrected that on 27 May 2026 and said anyone who had already installed the May updates needs to do nothing more. Microsoft first rated exploitation as less likely. On 1 July 2026 CISA added the flaw to its list of vulnerabilities being used in attacks and marked it as used in ransomware. The CVSS score is 8.8. Fixed builds are 16.0.19725.20280 (Subscription Edition), 16.0.10417.20128 (2019) and 16.0.5552.1002 (2016 Enterprise). Microsoft's own advisory page could not be loaded for this record, so these details come from Help Net Security's report and CISA's listing. SharePoint Online, which Microsoft runs, is not named as affected.","action":"If your business runs SharePoint Server itself, check that the May 2026 updates (or later) are installed, so builds are at or above the fixed versions. Ask your IT provider to review user accounts and check servers for signs of compromise. Home users have nothing to do.","product":"Microsoft SharePoint Server (on-premises) 2016 Enterprise, 2019 and Subscription Edition","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-45659"],"tags":["microsoft","sharepoint","cisa-kev","ransomware","remote-code-execution","deserialization","on-premises"],"affected":["Microsoft SharePoint Enterprise Server 2016 below 16.0.5552.1002","Microsoft SharePoint Server 2019 below 16.0.10417.20128","Microsoft SharePoint Server Subscription Edition below 16.0.19725.20280"],"fixed":["16.0.5552.1002 (SharePoint Enterprise Server 2016)","16.0.10417.20128 (SharePoint Server 2019)","16.0.19725.20280 (SharePoint Server Subscription Edition)"],"matches":[],"sources":[{"kind":"advisory","title":"Microsoft Security Update Guide: CVE-2026-45659 (page did not load its details)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659","by":"Microsoft","date":"2026-05-27"},{"kind":"news","title":"High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659)","url":"https://helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659","by":"Help Net Security","date":"2026-05-26"}],"started":"2026-07-01","closed":"2026-07-01","created":"2026-11-03T22:02:32.428Z","updated":"2026-11-03T22:02:32.428Z","cve_notes":[{"cve":"CVE-2026-45659","name":"Deserialization flaw in SharePoint Server","what":"A deserialization of untrusted data flaw in on-premises SharePoint Server that lets an attacker with a low-privilege account run their own code on the server over the network.","severity":"high","cvss":8.8}],"timeline":[{"at":"2026-07-01","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2026-45659 to its list of flaws being used in attacks, and its entry marks it as used by ransomware gangs. Help Net Security recorded the addition in a 2 July update, with a federal remediation deadline of 4 July 2026.","url":"https://helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659","by":"Help Net Security","patch":null},{"at":"2026-05-27","added":"2026-11-03T22:00:26.134Z","kind":"vendor-revised","text":"Microsoft corrected its advisory to say the fix shipped in the May 2026 updates. It said customers who had already installed those updates need take no further action.","url":"https://helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659","by":"Help Net Security","patch":null},{"at":"2026-05-26","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Help Net Security reported that Microsoft had fixed CVE-2026-45659, a code-execution flaw in on-premises SharePoint Server, in its May 2026 updates. Microsoft's advisory had left the CVE out of the May security update notes, and rated exploitation as less likely at the time.","url":"https://helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659","by":"Help Net Security","patch":"patched"}],"url":"https://hard.fyi/live/sharepoint-deserialization-cve-2026-45659-jul-2026/","json":"https://hard.fyi/api/live?id=sharepoint-deserialization-cve-2026-45659-jul-2026"}