Microsoft SharePoint Server code-execution flaw CVE-2026-45659 used in attacks, including by ransomware gangs
Attackers, including ransomware gangs, are using CVE-2026-45659 in on-premises SharePoint Server (2016, 2019, Subscription Edition). Microsoft fixed it in May 2026. If you run SharePoint yourself, confirm the May 2026 updates are installed.
If your business runs SharePoint Server itself, check that the May 2026 updates (or later) are installed, so builds are at or above the fixed versions. Ask your IT provider to review user accounts and check servers for signs of compromise. Home users have nothing to do.
What’s happening
CVE-2026-45659 is a deserialization flaw in on-premises Microsoft SharePoint Server. An attacker who has a low-privilege account on the server can send it crafted data over the network and run their own code on it. It affects SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Enterprise Server 2016. Microsoft fixed it in its May 2026 updates, but the advisory initially left the CVE out of the May update notes. Microsoft corrected that on 27 May 2026 and said anyone who had already installed the May updates needs to do nothing more. Microsoft first rated exploitation as less likely. On 1 July 2026 CISA added the flaw to its list of vulnerabilities being used in attacks and marked it as used in ransomware. The CVSS score is 8.8. Fixed builds are 16.0.19725.20280 (Subscription Edition), 16.0.10417.20128 (2019) and 16.0.5552.1002 (2016 Enterprise). Microsoft's own advisory page could not be loaded for this record, so these details come from Help Net Security's report and CISA's listing. SharePoint Online, which Microsoft runs, is not named as affected.
- What
- Flaw
- Affects
- Microsoft SharePoint Server (on-premises) 2016 Enterprise, 2019 and Subscription Edition
- Affected
- Microsoft SharePoint Enterprise Server 2016 below 16.0.5552.1002
Microsoft SharePoint Server 2019 below 16.0.10417.20128
Microsoft SharePoint Server Subscription Edition below 16.0.19725.20280 - Fixed in
- 16.0.5552.1002 (SharePoint Enterprise Server 2016)
16.0.10417.20128 (SharePoint Server 2019)
16.0.19725.20280 (SharePoint Server Subscription Edition) - Since
- 1 July 2026
- Closed
- 1 July 2026
Timeline
- CISA added
CISA added CVE-2026-45659 to its list of flaws being used in attacks, and its entry marks it as used by ransomware gangs. Help Net Security recorded the addition in a 2 July update, with a federal remediation deadline of 4 July 2026.
- Vendor revised
Microsoft corrected its advisory to say the fix shipped in the May 2026 updates. It said customers who had already installed those updates need take no further action.
- Made publicFixed
Help Net Security reported that Microsoft had fixed CVE-2026-45659, a code-execution flaw in on-premises SharePoint Server, in its May 2026 updates. Microsoft's advisory had left the CVE out of the May security update notes, and rated exploitation as less likely at the time.
Sources
- Microsoft Security Update Guide: CVE-2026-45659 (page did not load its details)Microsoft · 27 May 2026
- High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659)Help Net Security · 26 May 2026