CVE-2026-45659: Microsoft SharePoint Server Deserialization Remote Code Execution Bug - What It Means for Your Business and How to Respond

Introduction

If your organization operates on-premises Microsoft SharePoint Server, CVE-2026-45659 requires prompt attention. The vulnerability can place business operations, sensitive information, and customer trust at risk when an attacker gains access to a legitimate low-privilege account. The issue affects organizations in the United States and Canada across industries, including financial services, healthcare, government, manufacturing, education, and professional services.

This post explains why the vulnerability matters to your business, how to determine whether your environment is affected, and what response priorities should guide your next steps. It also outlines practical actions for reducing exposure while your security and information technology teams complete patching, verification, and compromise assessment.

S1: Background & History

CVE-2026-45659 affects on-premises Microsoft SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Microsoft is identified as the reporting organization, and the vulnerability was disclosed through a Microsoft security advisory on May 21, 2026. The National Vulnerability Database published the CVE record on May 22, 2026.

The flaw is unsafe deserialization, which means the software can process specially constructed data in a way that allows unintended actions. The Common Vulnerability Scoring System version 3.1 rates it 8.8 out of 10, or High severity. The score reflects network reachability, low attack complexity, low privileges required, no user interaction, and high potential impact to confidentiality, integrity, and availability.

Microsoft’s May 2026 updates addressed the issue, although the CVE was initially omitted from the published security update information. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on July 1, 2026. The Canadian Centre for Cyber Security issued a related alert on July 2 after confirming active exploitation.

S2: What This Means for Your Business

If an attacker obtains a valid low-privilege SharePoint account, the attacker may be able to run unauthorized code on a vulnerable server. That access can allow the attacker to view or alter documents, disrupt collaboration sites, create persistence, interfere with business applications, or use the SharePoint server as a starting point for attacks against other systems.

Your operational risk depends on how deeply SharePoint is connected to your environment. A compromised server may provide access to sensitive project files, employee information, customer records, intellectual property, legal documents, or regulated data. It may also interrupt document workflows, internal communications, approval processes, and access to business-critical information.

You may face notification obligations if an investigation finds that personal, financial, health, or confidential customer data was accessed. U.S. organizations may need to consider state breach-notification laws, contractual commitments, sector requirements, and federal expectations. Canadian organizations should also assess applicable federal or provincial privacy obligations, including requirements that may apply to personal information held by the organization.

The reputational impact can extend beyond the technical incident. Customers, partners, insurers, lenders, and regulators may question whether you protected an internet-accessible business system and controlled access to sensitive data. Because the vulnerability is listed in CISA’s exploited-vulnerability catalog, you should treat it as an active business risk rather than a routine patching item.

S3: Real-World Examples

• Regional bank: If you operate a regional bank, an attacker could use a compromised employee or contractor account to access SharePoint-hosted lending documents, audit material, or internal procedures. A resulting outage could delay loan processing and increase regulatory scrutiny while investigators determine whether customer information was exposed.
• Healthcare provider: If you manage a hospital network or medical practice, SharePoint may contain administrative records, clinical workflows, vendor documentation, or staff information. A compromised server could interrupt access to operational files and create privacy concerns if protected information is copied or altered.
• Mid-sized manufacturer: If you run a manufacturing company, engineering drawings, supplier agreements, production instructions, and quality records may be stored in SharePoint. An attacker could modify documents, disrupt production planning, or use the server to reach connected systems.
• Public-sector organization: If you support a municipal, provincial, state, or federal department, SharePoint may support case management and interdepartmental collaboration. A compromise could expose confidential records, undermine public confidence, and create reporting obligations even if essential public services remain available.

S4: Am I Affected?

• Yes if you run Microsoft SharePoint Enterprise Server 2016 below build 16.0.5552.1002. Microsoft’s May 2026 update is KB5002868.
• Yes if you run Microsoft SharePoint Server 2019 below build 16.0.10417.20128. Microsoft’s May 2026 update is KB5002870.
• Yes if you run Microsoft SharePoint Server Subscription Edition below build 16.0.19725.20280. Microsoft’s May 2026 update is KB5002863.
• Yes if you have an on-premises SharePoint farm exposed directly or indirectly to the internet, especially when external users, contractors, partners, or remote employees can authenticate to it.
• Yes if your patch records show that May 2026 updates were approved but your team has not verified the actual build number on every SharePoint server.
• No immediate exposure is indicated if every affected server meets or exceeds its required fixed build, the farm is fully updated, and a security review has found no suspicious activity. Continue monitoring because patching does not remove evidence of an earlier compromise.

Key Takeaways

• You should treat CVE-2026-45659 as a priority because attackers are actively exploiting it against on-premises SharePoint Server.
• You should verify actual SharePoint build numbers instead of relying only on a patch-management status or change-ticket record.
• You should review low-privilege accounts, external access, and internet exposure because an administrator-level account is not required for exploitation.
• You should investigate suspicious activity before and after patching if your SharePoint environment was exposed or remained unpatched.
• You should include SharePoint in broader vulnerability management, identity protection, network segmentation, and incident-response planning.

Call to Action

Do not let a patching task become a business interruption. IntegSec can assess your SharePoint exposure, test authentication and access controls, identify paths to sensitive systems, and help reduce cybersecurity risk through a focused penetration test. Contact IntegSec to turn remediation into measurable security improvement.

Technical Appendix

A: Technical Analysis

CVE-2026-45659 is a remote code execution vulnerability caused by deserialization of untrusted data in Microsoft SharePoint Server. The affected component accepts attacker-controlled serialized input and processes it without sufficient validation of the resulting object or permitted behavior. The public vulnerability record does not identify a specific endpoint or provide a complete exploit chain, so defenders should avoid assuming that a single URL or payload pattern represents the entire attack surface.

The attack vector is network-based. Exploitation requires an authenticated, low-privilege SharePoint account, has low attack complexity, requires no user interaction, and has unchanged scope. Successful exploitation may provide code execution in the context of the SharePoint application process, potentially affecting hosted content and connected services.

The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, with a base score of 8.8 High. The NVD reference is CVE-2026-45659. The associated weakness is CWE-502, Deserialization of Untrusted Data.

B: Detection & Verification

A SharePoint administrator can enumerate the farm build with Get-SPFarm | Select-Object BuildVersion. The local product inventory can be reviewed with Get-SPProduct -Local | Format-List ProductName,PatchableUnitDisplayName,PatchableUnitVersion. Verification should occur on every farm server, not only the server used to perform the update.

Vulnerability scanners should use current Microsoft SharePoint content. Tenable lists plugins 314338 for Subscription Edition, 314344 for SharePoint 2016, and 314345 for SharePoint 2019. Scanner results should be reconciled with the installed build because incomplete farm deployment can produce misleading status information.

Detection engineering should monitor Internet Information Services logs for unusual authenticated POST requests, unusually large request bodies, and requests to SharePoint handler paths. SharePoint Unified Logging System records should be reviewed for deserialization exceptions and type-loading failures. Windows process-creation telemetry should identify w3wp.exe spawning cmd.exe, powershell.exe, csc.exe, or other unexpected child processes. Unexpected outbound connections from a SharePoint server, new application files, altered web configuration, and changes in SharePoint layout directories warrant investigation.

C: Mitigation & Remediation

• Immediate, 0 to 24h: Inventory every on-premises SharePoint farm, including disaster-recovery and test environments. Apply the official Microsoft updates first: KB5002863 for Subscription Edition, KB5002870 for SharePoint Server 2019, and KB5002868 for SharePoint Server 2016. Confirm the fixed build on every server and complete the required SharePoint configuration step after installation. Restrict unnecessary internet exposure while deployment proceeds.
• Immediate, 0 to 24h: If patching cannot be completed, limit SharePoint access to trusted networks through a firewall, virtual private network, or reverse proxy. Remove stale external accounts, suspend unused low-privilege accounts, and review recent authentication activity. These controls reduce exposure but do not replace the vendor update.
• Short-term, 1 to 7d: Preserve IIS, SharePoint Unified Logging System, Windows Security, endpoint detection, and network telemetry. Investigate suspicious requests, process creation, new files, scheduled tasks, service changes, and outbound connections. If compromise indicators exist, isolate affected servers, begin incident response, rotate exposed credentials, and evaluate machine-key rotation with Microsoft-supported recovery guidance.
• Short-term, 1 to 7d: Where supported, enable Microsoft Antimalware Scan Interface integration for SharePoint and use Full Mode for request-body scanning when operationally feasible. A web application firewall may add detection for anomalous serialized requests and oversized POST bodies, but it should be treated as defense in depth rather than a patch substitute.
• Long-term, ongoing: Establish continuous farm inventory, build verification, privileged-access review, centralized logging, and vulnerability-management ownership. SharePoint Server 2016 and 2019 reached end of support on July 14, 2026, so organizations still running those editions should plan migration to a supported platform rather than relying on repeated emergency patching.

D: Best Practices

• Enforce least privilege for SharePoint site membership, service accounts, administrators, contractors, and external collaborators.
• Require strong authentication for remote and external access, and remove accounts that no longer have a documented business purpose.
• Keep internet-facing SharePoint systems behind controlled network boundaries, with administrative interfaces restricted to trusted networks.
• Enable request inspection through supported Antimalware Scan Interface features and centralize IIS, SharePoint, endpoint, and authentication logs.
• Test restoration from protected backups and rehearse incident response for a compromised collaboration server, including credential and machine-key recovery procedures.