As reported by CISA via their Known Exploited Vulnerabilities (KEV) Catalog advisory, CVE-2026-45659 — a deserialization of untrusted data vulnerability affecting Microsoft SharePoint Server — has been confirmed as actively exploited in the wild. This addition to CISA's KEV Catalog is not a routine administrative update; it carries serious operational weight for any organization running SharePoint in a public-facing or internally networked capacity.

Security Impact: As reported by CISA via their Known Exploited Vulnerabilities (KEV) Catalog advisory, CVE-2026-45659 — a deserialization of untrusted data vulnerability affecting Microsoft SharePoint Server — has been confirmed as actively exploited in the wild.

Vulnerability at a Glance

CVE ID
CVE-2026-45659
Affected Product
Microsoft SharePoint Server
Vulnerability Type
Deserialization of Untrusted Data (CWE-502)
Exploitation Status
⚠️ Actively exploited in the wild (confirmed by CISA)
CVSS / Severity
Not yet publicly confirmed at time of writing — check the NVD entry and Microsoft's Security Update Guide for updated scoring
Patch Available
Refer to Microsoft Security Response Center (MSRC) for the latest patch guidance
Post-Exploitation Impact
Total control of the affected asset

Why This Vulnerability Is Particularly Dangerous

Deserialization vulnerabilities occupy a unique and especially treacherous tier in the threat landscape. Unlike many common web vulnerabilities, deserialization flaws can enable remote code execution (RCE) with relatively little interaction from a victim — no phishing email, no user click required if the endpoint is externally accessible. The attacker sends a crafted payload to the server, which then trustingly unpacks and executes it.

SharePoint amplifies this risk considerably. As one of Microsoft's most widely deployed enterprise collaboration platforms, SharePoint frequently sits at the intersection of internal document management, external partner portals, and legacy integrations — making it both high-value and highly interconnected. Compromise of a SharePoint server can cascade into broader Active Directory abuse, lateral movement, and data exfiltration.

CISA's KEV Catalog addition is the clearest signal available that this vulnerability has transitioned from theoretical to operational threat. Organizations that delay patching are not managing risk — they are accepting it.

Who Is Most at Risk

Why This Vulnerability Is Particularly Dangerous
Federal Civilian Executive Branch (FCEB) agencies — bound by BOD 26-04 and subject to mandatory remediation timelines for KEV-listed vulnerabilities on publicly exposed assets
Enterprise organizations running on-premises or hybrid SharePoint deployments, particularly those with internet-facing SharePoint portals
Healthcare, financial services, and legal sectors — industries that routinely use SharePoint for document management and regulatory workflows, and hold high-value data that attracts sophisticated threat actors
Mid-market organizations with smaller IT teams that may lack automated patch orchestration or vulnerability scanning cadences

The Broader Threat Context

Deserialization vulnerabilities in enterprise platforms like SharePoint have historically been weaponized by both financially motivated ransomware groups and nation-state actors. The 2021 ProxyLogon/ProxyShell Exchange Server attack wave demonstrated how quickly threat actors move to mass-exploit newly disclosed Microsoft server flaws — often within hours of public disclosure. The confirmation of active exploitation here suggests adversaries are already ahead of many defenders.

BOD 26-04's framework, which introduces risk-tiering for federal vulnerability management, is a meaningful policy evolution. However, the practical urgency for private sector defenders is identical: when CISA confirms active exploitation and post-exploitation total control of assets, this is a Severity 1 incident response posture for patch deployment.

Shield53 Recommendations — Immediate Actions

1. Patch Immediately

Consult the Microsoft Security Response Center for the specific patch or cumulative update addressing CVE-2026-45659. Apply patches to all SharePoint Server instances, prioritizing internet-facing deployments.

2. Audit Exposure

  • Identify all SharePoint Server instances in your environment, including legacy or departmental deployments that may lack centralized oversight
  • Determine which instances have public internet exposure and treat those as critical priority

3. Hunt for Pre-Patch Compromise

  • Review SharePoint server logs for anomalous deserialization activity, unusual process spawning (e.g., w3wp.exe spawning cmd.exe or powershell.exe), or unexpected outbound connections
  • Correlate with endpoint detection telemetry for lateral movement indicators originating from SharePoint hosts
  • Check for webshell artifacts in SharePoint web directories

4. Implement Network-Level Controls

  • If patching cannot be completed immediately, restrict external access to SharePoint via WAF rules or network ACLs as a temporary mitigation
  • Enable enhanced logging at the network perimeter for SharePoint traffic

5. Update Threat Intelligence Feeds

Add CVE-2026-45659 to your vulnerability management platform and SIEM alerting rules. Ensure your threat intelligence tooling is flagging IOCs associated with this vulnerability's active exploitation campaigns.

The window between CISA's KEV Catalog addition and widespread attacker exploitation at scale is narrow. Treat this as a time-critical remediation event, not a scheduled patching task.