What Changed
CISA has updated its Known Exploited Vulnerabilities catalog to flag CVE-2026-45659, a Microsoft SharePoint Server remote code execution flaw, as used in ransomware attacks. The bug is a deserialization of untrusted data weakness that lets attackers with low privileges run code on unpatched servers in low-complexity attacks.
Microsoft released fixes in May for SharePoint Enterprise Server 2016, SharePoint Server 2019 and SharePoint Server Subscription Edition. CISA added the flaw to KEV on July 1 with a three-day deadline for federal civilian agencies. Microsoft had not yet marked its own advisory as exploited at the time of the update.
Why This Is An Operations Problem
Shadowserver tracks more than 8,500 SharePoint servers exposed online, over 200 of them still unpatched against this flaw. Ransomware use changes the stakes: the likely outcome of a compromise is no longer limited to data theft but includes encryption of systems connected to the farm.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
SharePoint has a long record here. Since November 2021 CISA has flagged 14 actively exploited SharePoint vulnerabilities, eight of them also used by ransomware operators.
What To Verify First
- Confirm the May SharePoint updates are installed and verified on every farm server.
- Enable AMSI integration for SharePoint web applications and make sure Microsoft Defender Antivirus detections are monitored.
- Review servers for signs of exploitation since at least early July, including web shells and unusual worker-process activity.
- Limit internet exposure of on-premises SharePoint where it is not required.
What Teams May Be Underestimating
Because the flaw needs only low privileges, any compromised user account with SharePoint access can become an entry point. Credential hygiene and patching need to move together.
Source Context
This item was rebuilt from the following primary sources and original reporting:
- BleepingComputer: CISA: Microsoft SharePoint flaw now exploited in ransomware attacks
- NVD: CVE-2026-45659
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
