This combination of low privileges, no user interaction, and network-based access makes this a prime target for attackers, as a single compromised standard user account can serve as the gateway to total server control.

Affected Versions

This is an on-premises issue. The vulnerability affects the following three versions of SharePoint Server. SharePoint Online is not affected .

• Microsoft SharePoint Server Subscription Edition (pre-16.0.5552.1002)
• Microsoft SharePoint Server 2019 (pre-16.0.10417.20128)
• Microsoft SharePoint Enterprise Server 2016 (pre-16.0.5552.1002)

For each affected version, Microsoft has provided a specific update and build number that administrators can use to verify their patch level. The patch was made available on May 12, 2026 as part of a standard security update but was further emphasized after its severity was clarified .

A Broader Pattern of SharePoint Deserialization Attacks

CVE-2026-45659 is not an isolated incident. It is the latest in a series of high-impact SharePoint deserialization vulnerabilities that have plagued on-premises deployments.

A key example is CVE-2026-20963, a similar flaw that had a confirmed CVSS score of 9.8 and was so dangerous that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog on March 18, 2026, after confirming active exploitation . CERT-EU reported that Microsoft had to update its advisory for CVE-2026-20963 to clarify that the vulnerability was exploitable by an unauthenticated attacker—meaning no login was required at all .

Other related issues, such as CVE-2026-33110, also involve deserialization of untrusted data and affect the same product lines . The pattern is clear: attackers and security researchers are heavily scrutinizing SharePoint's deserialization mechanisms, and critical flaws are being discovered at an alarming rate. This trend makes robust and timely patching more critical than ever for SharePoint administrators.

Mitigation and Defense Strategies

Patching is the only complete solution, but a defense-in-depth approach provides additional protection. For organizations that must run on-premises SharePoint, here are the recommended steps:

1. Apply the Patch Immediately: This is the single most important action. Locate and deploy the specific security update for your SharePoint version, prioritizing any server accessible from the internet .
2. Audit and Restrict User Privileges: Since CVE-2026-45659 requires only Site Member access, a thorough review of user permissions is critical. Adopt the principle of least privilege and remove unnecessary user access .
3. Harden Server Monitoring: Deploy an endpoint detection and response (EDR) solution to look for post-exploitation activity. Security teams should watch for suspicious process creation from SharePoint's application pool (w3wp.exe), unusual outbound network connections or web shells, and abnormal behavior from service accounts.
4. Verify Remediation of Related Flaws: A patch for CVE-2026-45659 is essential, but a server remains vulnerable if it is still unpatched for the actively exploited CVE-2026-20963. Use this patching cycle to confirm all related SharePoint security updates have been applied .
5. Reduce Attack Surface: If SharePoint servers do not need to be accessible from the public internet, implement network-level restrictions to block all external access. For services that must be public-facing, ensure they sit behind a web application firewall (WAF) configured with rules to block common deserialization attacks.

This combination of low privileges, no user interaction, and network-based access makes this a prime target for attackers, as a single compromised standard user account can serve as the gateway to total server control.

Affected Versions

This is an on-premises issue. The vulnerability affects the following three versions of SharePoint Server. SharePoint Online is not affected .

• Microsoft SharePoint Server Subscription Edition (pre-16.0.5552.1002)
• Microsoft SharePoint Server 2019 (pre-16.0.10417.20128)
• Microsoft SharePoint Enterprise Server 2016 (pre-16.0.5552.1002)

For each affected version, Microsoft has provided a specific update and build number that administrators can use to verify their patch level. The patch was made available on May 12, 2026 as part of a standard security update but was further emphasized after its severity was clarified .

A Broader Pattern of SharePoint Deserialization Attacks

CVE-2026-45659 is not an isolated incident. It is the latest in a series of high-impact SharePoint deserialization vulnerabilities that have plagued on-premises deployments.

A key example is CVE-2026-20963, a similar flaw that had a confirmed CVSS score of 9.8 and was so dangerous that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog on March 18, 2026, after confirming active exploitation . CERT-EU reported that Microsoft had to update its advisory for CVE-2026-20963 to clarify that the vulnerability was exploitable by an unauthenticated attacker—meaning no login was required at all .

Other related issues, such as CVE-2026-33110, also involve deserialization of untrusted data and affect the same product lines . The pattern is clear: attackers and security researchers are heavily scrutinizing SharePoint's deserialization mechanisms, and critical flaws are being discovered at an alarming rate. This trend makes robust and timely patching more critical than ever for SharePoint administrators.

Mitigation and Defense Strategies

Patching is the only complete solution, but a defense-in-depth approach provides additional protection. For organizations that must run on-premises SharePoint, here are the recommended steps:

1. Apply the Patch Immediately: This is the single most important action. Locate and deploy the specific security update for your SharePoint version, prioritizing any server accessible from the internet .
2. Audit and Restrict User Privileges: Since CVE-2026-45659 requires only Site Member access, a thorough review of user permissions is critical. Adopt the principle of least privilege and remove unnecessary user access .
3. Harden Server Monitoring: Deploy an endpoint detection and response (EDR) solution to look for post-exploitation activity. Security teams should watch for suspicious process creation from SharePoint's application pool (w3wp.exe), unusual outbound network connections or web shells, and abnormal behavior from service accounts.
4. Verify Remediation of Related Flaws: A patch for CVE-2026-45659 is essential, but a server remains vulnerable if it is still unpatched for the actively exploited CVE-2026-20963. Use this patching cycle to confirm all related SharePoint security updates have been applied .
5. Reduce Attack Surface: If SharePoint servers do not need to be accessible from the public internet, implement network-level restrictions to block all external access. For services that must be public-facing, ensure they sit behind a web application firewall (WAF) configured with rules to block common deserialization attacks.