CISA Warns of Active Exploitation of SharePoint RCE Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a warning Wednesday that malicious actors have started targeting a high-severity remote code execution vulnerability in Microsoft SharePoint.

CISA adds CVE-2026-45659 to its Known Exploited Vulnerabilities catalog. The agency placed the flaw in the catalog on July 1, 2026, and directed Federal Civilian Executive Branch agencies to apply fixes by July 4. This step aligns with Binding Operational Directive 26-04, released last month, which sets priorities according to KEV listing, potential for automated large-scale exploitation, online exposure of assets, and whether successful compromise delivers partial or full control.

The issue arises from deserialization of untrusted data and reportedly enables authenticated users holding minimal rights to run arbitrary code on vulnerable SharePoint servers through straightforward network attacks that require no user interaction.

Microsoft details low-privilege, network-based attack requirements. "Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges. In a network-based attack, an authenticated attacker, who has a minimum of Site Member permissions (PR:L), could execute code remotely on the SharePoint Server," Microsoft explains. The company classifies the attack vector as Network because the bug can be reached from the internet and lists attack complexity as Low since little advance system knowledge is needed for repeatable success.

Fixes for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition arrived on May 21. Microsoft noted that the CVE identifier had been accidentally omitted from the May 2026 Security Updates.

Shadowserver tracks more than 10,000 exposed SharePoint servers. The internet security watchdog group is currently monitoring over 10,000 SharePoint servers reachable online. No figures exist on how many of those systems have received the May patches and are therefore shielded from ongoing CVE-2026-45659 exploitation.

SharePoint vulnerabilities have been frequent targets since 2021. Since then CISA has cataloged 11 Microsoft SharePoint bugs exploited in the wild, seven of which also featured in ransomware campaigns. During the April 2026 Patch Tuesday, Microsoft fixed a different SharePoint vulnerability that had been used in zero-day attacks.

CISA stated that flaws of this nature serve as common entry points for malicious cyber actors and create major threats across federal networks. Agencies must follow applicable BOD 26-04 guidance for cloud services or stop using the product when no mitigations exist. Each organization bears responsibility for assessing internet exposure of its assets and complying with BOD 26-04 patching rules.