Microsoft Patches New SharePoint RCE Vulnerability CVE-2026-45659 as Threat Landscape Intensifies

Microsoft has released an emergency fix for a dangerous new vulnerability in SharePoint Server, just two weeks after its regular Patch Tuesday updates. The bug, designated CVE-2026-45659, enables an attacker with basic login credentials to seize a server completely, underscoring an alarming pattern of critical flaws in on-premises SharePoint deployments. For security teams managing their own SharePoint farms, this isn't just another patch—it's an urgent priority.

Vulnerability Analysis: How CVE-2026-45659 Works

CVE-2026-45659 is a classic and dangerous type of software flaw: a deserialization of untrusted data vulnerability, formally tracked as CWE-502 . In simple terms, SharePoint accepts and processes complex data "packages" from users. Due to the flaw, an attacker can craft a malicious package that, when "unpacked" (deserialized) by the server, executes code of the attacker's choice.

The technical specifications of the vulnerability make it easy to exploit:

• CVSS 3.1 Score: 8.8 (High) .
• Attack Vector: Network-based .
• Attack Complexity: Low .
• Privileges Required: Low. An attacker needs only basic Site Member privileges on the SharePoint server .
• User Interaction: None. The attack can be carried out without unsuspecting users clicking a link or downloading a file .
• Impact: High on confidentiality, integrity, and availability, meaning a successful attack can lead to a complete system compromise and data breach .

This combination of low privileges, no user interaction, and network-based access makes this a prime target for attackers, as a single compromised standard user account can serve as the gateway to total server control.

Affected Versions

This is an on-premises issue. The vulnerability affects the following three versions of SharePoint Server. SharePoint Online is not affected .

• Microsoft SharePoint Server Subscription Edition (pre-16.0.5552.1002)
• Microsoft SharePoint Server 2019 (pre-16.0.10417.20128)
• Microsoft SharePoint Enterprise Server 2016 (pre-16.0.5552.1002)

For each affected version, Microsoft has provided a specific update and build number that administrators can use to verify their patch level. The patch was made available on May 12, 2026 as part of a standard security update but was further emphasized after its severity was clarified .

A Broader Pattern of SharePoint Deserialization Attacks

CVE-2026-45659 is not an isolated incident. It is the latest in a series of high-impact SharePoint deserialization vulnerabilities that have plagued on-premises deployments.

A key example is CVE-2026-20963, a similar flaw that had a confirmed CVSS score of 9.8 and was so dangerous that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog on March 18, 2026, after confirming active exploitation . CERT-EU reported that Microsoft had to update its advisory for CVE-2026-20963 to clarify that the vulnerability was exploitable by an unauthenticated attacker—meaning no login was required at all .

Other related issues, such as CVE-2026-33110, also involve deserialization of untrusted data and affect the same product lines . The pattern is clear: attackers and security researchers are heavily scrutinizing SharePoint's deserialization mechanisms, and critical flaws are being discovered at an alarming rate. This trend makes robust and timely patching more critical than ever for SharePoint administrators.

Mitigation and Defense Strategies

Patching is the only complete solution, but a defense-in-depth approach provides additional protection. For organizations that must run on-premises SharePoint, here are the recommended steps:

1. Apply the Patch Immediately: This is the single most important action. Locate and deploy the specific security update for your SharePoint version, prioritizing any server accessible from the internet .
2. Audit and Restrict User Privileges: Since CVE-2026-45659 requires only Site Member access, a thorough review of user permissions is critical. Adopt the principle of least privilege and remove unnecessary user access .
3. Harden Server Monitoring: Deploy an endpoint detection and response (EDR) solution to look for post-exploitation activity. Security teams should watch for suspicious process creation from SharePoint's application pool (w3wp.exe), unusual outbound network connections or web shells, and abnormal behavior from service accounts.
4. Verify Remediation of Related Flaws: A patch for CVE-2026-45659 is essential, but a server remains vulnerable if it is still unpatched for the actively exploited CVE-2026-20963. Use this patching cycle to confirm all related SharePoint security updates have been applied .
5. Reduce Attack Surface: If SharePoint servers do not need to be accessible from the public internet, implement network-level restrictions to block all external access. For services that must be public-facing, ensure they sit behind a web application firewall (WAF) configured with rules to block common deserialization attacks.