CVE-2026-45659

What it actually does

This vulnerability is a network-exploitable deserialization flaw in Microsoft SharePoint Server. An authenticated attacker with low privileges can submit crafted serialized data to SharePoint that is processed by the server and results in arbitrary code execution in the SharePoint application context. Because exploitation requires no user interaction and can lead to full confidentiality, integrity, and availability impact, a successful attack may allow command execution, deployment of web shells, credential theft, lateral movement, data exfiltration, or service disruption.

Why it matters to the business

Compromise of a SharePoint server can expose sensitive documents, internal collaboration content, credentials, and business workflows, while also giving attackers a foothold inside the network. This issue is listed in CISA KEV with active exploitation in the wild and a remediation due date of 2026-07-04, making it a high-priority operational risk even though ransomware use has not been specifically reported. Organizations relying heavily on SharePoint for document management, intranet portals, or business process automation could face data theft, downtime, compliance exposure, and costly incident response if vulnerable systems remain exposed.

How an attack unfolds

An attacker first obtains or abuses valid SharePoint credentials for a low-privileged account. They then send a crafted network request containing malicious serialized data to a vulnerable SharePoint component. When SharePoint deserializes that untrusted data, attacker-controlled code is executed on the server, typically under the IIS worker process or SharePoint service context. After code execution, the attacker may run reconnaissance commands, write an ASPX web shell, dump configuration secrets, access SharePoint content databases indirectly through the application, steal tokens or credentials, and move laterally to other internal systems. Because this vulnerability is actively exploited in the wild, defenders should assume exposed unpatched SharePoint servers may have already been probed or compromised.

How to fix it

Apply the Microsoft security update that remediates CVE-2026-45659 for all supported Microsoft SharePoint Server deployments as soon as it is available for the affected version. No exact fixed version was provided in the input, so administrators should consult the Microsoft Security Update Guide and install the latest cumulative/security updates for the deployed SharePoint Server release. Prioritize internet-facing SharePoint systems and any servers accessible by broad internal user populations. If immediate patching is not possible, reduce exposure by restricting SharePoint access to trusted networks or VPN, enforcing strong authentication and MFA, disabling unused SharePoint features and custom endpoints, reviewing low-privileged account access, and increasing monitoring for SharePoint worker-process child processes and unexpected ASPX file creation. Mitigations should be treated as temporary; patching is the durable fix.

How to confirm the fix worked

Confirm that every SharePoint server in the farm has the relevant Microsoft security update installed and that product build numbers match Microsoft’s fixed build guidance for the deployed SharePoint release. Verify patch consistency across web front ends, application servers, and any standby or disaster recovery SharePoint servers. Run the SharePoint Products Configuration Wizard or equivalent post-update configuration steps where required by Microsoft. Validate externally and internally that no unpatched SharePoint endpoints remain reachable. Review IIS, SharePoint ULS, Windows Security, PowerShell, Sysmon or EDR telemetry for signs of exploitation before declaring remediation complete, because patching does not remove web shells, stolen credentials, scheduled tasks, or other attacker persistence.

Typical attack path

1. Identify an internet-facing or internally reachable Microsoft SharePoint Server instance.
2. Acquire or reuse valid low-privileged SharePoint credentials through phishing, password reuse, credential theft, or prior compromise.
3. Submit a crafted request containing malicious serialized data to the vulnerable SharePoint functionality.
4. Trigger unsafe deserialization on the server and gain code execution in the SharePoint/IIS application context.
5. Execute operating system commands through the SharePoint worker process.
6. Deploy persistence such as an ASPX web shell, scheduled task, service, or modified SharePoint artifact.
7. Collect SharePoint configuration data, documents, authentication material, and environment information.
8. Use the compromised server as a pivot point for lateral movement, privilege escalation, or data exfiltration.

How to detect it

To determine whether exploitation already occurred, correlate authentication, web request, process execution, file creation, and endpoint telemetry around SharePoint servers. Review IIS logs for unusual authenticated POST requests, abnormal request bursts, atypical user agents, requests from unexpected source IPs, and activity from low-privileged accounts immediately followed by server-side process creation. Examine SharePoint ULS logs for serialization/deserialization exceptions, unexpected application errors, or anomalous requests near suspicious authentication events. In Windows Security, Sysmon, PowerShell, and EDR logs, look for the IIS worker process w3wp.exe or SharePoint service processes spawning cmd.exe, powershell.exe, pwsh.exe, cscript.exe, wscript.exe, rundll32.exe, mshta.exe, certutil.exe, bitsadmin.exe, curl.exe, wget.exe, net.exe, nltest.exe, whoami.exe, or other administrative tools. Search SharePoint web roots and layouts directories for newly created or modified ASPX files, especially small obfuscated files, files containing command-execution functions, or files with timestamps close to suspicious IIS requests. Investigate outbound network connections from SharePoint servers to unfamiliar hosts, especially shortly after suspicious requests. Because the input identifies active exploitation in the wild but does not provide a unique exploit URI or malware family, detection should emphasize behavioral evidence of SharePoint-originated code execution and persistence rather than a single static signature.

• w3wp.exe
• powershell.exe
• pwsh.exe
• cmd.exe
• cscript.exe
• wscript.exe
• mshta.exe
• rundll32.exe
• certutil.exe
• bitsadmin.exe
• curl.exe
• wget.exe
• whoami.exe
• nltest.exe
• net.exe
• System.Runtime.Serialization
• BinaryFormatter.Deserialize
• LosFormatter.Deserialize
• /LAYOUTS/
• /_layouts/15/
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\
• .aspx
• System.Diagnostics.Process
• ProcessStartInfo
• cmd /c
• powershell -enc
• FromBase64String
• New-Object Net.WebClient
• Invoke-WebRequest
• Invoke-Expression
• IEX

What your security team should do

• Treat this as urgent because it is CISA KEV-listed, actively exploited in the wild, network exploitable, and requires only low-privileged authentication.
• Inventory all Microsoft SharePoint Server instances, including internet-facing, internal, development, disaster recovery, and legacy servers.
• Patch all affected SharePoint servers before the KEV due date of 2026-07-04, prioritizing externally reachable systems first.
• If patching cannot be completed immediately, restrict access to SharePoint to trusted networks and enforce MFA for all accounts with SharePoint access.
• Hunt for prior compromise using IIS logs, SharePoint ULS logs, Windows process creation logs, PowerShell logs, file integrity monitoring, and EDR telemetry.
• Investigate any SharePoint IIS worker process spawning command shells, scripting engines, archive tools, network utilities, or credential access tools.
• Search SharePoint web directories for newly created or modified ASPX files, especially files with unusual names, timestamps, or content inconsistent with the application baseline.
• Rotate credentials, secrets, and service account passwords if exploitation is suspected, especially SharePoint farm accounts, application pool identities, and privileged administrative accounts.
• Review low-privileged SharePoint accounts for suspicious logons, impossible travel, unusual user agents, unexpected file access, or abnormal request volume.
• Preserve forensic evidence before rebuilding or cleaning compromised servers, including IIS logs, ULS logs, Windows event logs, memory captures where feasible, and suspicious files.