CVE-2026-45454: SharePoint Server Path Traversal Flaw

CVE-2026-45454 Overview

CVE-2026-45454 is a path traversal vulnerability in Microsoft Office SharePoint Server that allows an authenticated attacker to execute arbitrary code over a network. The flaw stems from improper limitation of a pathname to a restricted directory [CWE-22], permitting attackers to manipulate file paths and reach resources outside the intended directory scope. Successful exploitation grants the attacker the ability to run code in the context of the SharePoint application, compromising confidentiality, integrity, and availability of hosted content. The vulnerability affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise.

Critical Impact
Authenticated attackers can execute arbitrary code on SharePoint servers across the network, gaining a foothold for lateral movement into collaboration data, identity stores, and connected backend systems.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-06-09 - CVE-2026-45454 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45454

Vulnerability Analysis

The vulnerability resides in SharePoint Server's handling of user-supplied path components when accessing or writing files on the server. SharePoint fails to properly canonicalize and validate pathname inputs before using them in file system operations. An authenticated attacker with low privileges can submit crafted input containing directory traversal sequences such as ..\ to escape the intended directory boundary.

Because the attack converts a path traversal weakness into code execution, the attacker can place or invoke files in locations that SharePoint or the underlying IIS worker process will load and execute. This converts a file-system primitive into remote code execution in the security context of the SharePoint application pool identity.

The attack requires only low privileges and no user interaction, which broadens the population of potential attackers to any user with valid SharePoint credentials, including users provisioned through federated identity sources.

Root Cause

The root cause is insufficient input validation and canonicalization on a file path parameter consumed by a SharePoint server-side handler. The vulnerable code path accepts traversal characters and resolves them against trusted directories without enforcing a strict allow-list of permitted locations, classifying the flaw under CWE-22.

Attack Vector

The attack vector is network-based over HTTP or HTTPS against the SharePoint web front-end. An authenticated attacker sends a crafted request to a vulnerable SharePoint endpoint, embedding traversal sequences in a parameter that the server interprets as a file path. The server resolves the path outside the intended directory and processes attacker-controlled content as executable code.

The vulnerability manifests when SharePoint joins untrusted input with a base directory and performs file I/O without normalizing the result. See the Microsoft Security Update CVE-2026-45454 advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-45454

Indicators of Compromise

HTTP requests to SharePoint endpoints containing path traversal sequences such as ..%2f, ..\, or encoded variants in query strings, form fields, or URL segments.
Unexpected files written to SharePoint LAYOUTS, _app_bin, or TEMPLATE directories, particularly .aspx, .ashx, or .dll files not present in known-good baselines.
New w3wp.exe child processes spawning cmd.exe, powershell.exe, or csc.exe under the SharePoint application pool identity.

Detection Strategies

Inspect IIS logs for requests to SharePoint handlers with traversal patterns, double-encoded slashes, or abnormally long path parameters.
Monitor SharePoint server file systems for write operations originating from the IIS worker process to directories outside the standard content store.
Correlate authentication events with subsequent file-access anomalies to identify low-privileged accounts performing reconnaissance against file-handling endpoints.

Monitoring Recommendations

Enable verbose IIS logging including query strings and cs-uri-stem fields on all SharePoint front-end servers.
Forward SharePoint Unified Logging Service (ULS) logs and Windows process-creation events (Event ID 4688) to a centralized analytics platform for correlation.
Baseline normal SharePoint web shell and binary locations, then alert on any deviation from that baseline.

How to Mitigate CVE-2026-45454

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-45454 to all SharePoint Server Subscription Edition, 2019, and 2016 deployments.
Audit SharePoint user accounts and revoke unnecessary authenticated access, prioritizing accounts with broad site collection permissions.
Review SharePoint server file systems and IIS logs for indicators of prior exploitation before and after patching.

Patch Information

Microsoft has published the security update through the Microsoft Security Response Center. Administrators should consult the Microsoft Security Update CVE-2026-45454 page for the specific KB articles and cumulative update packages matching each supported SharePoint Server version. Apply patches in a staged manner across development, staging, and production farms, and restart the IIS service or server as required by the update.

Workarounds

Restrict network access to SharePoint web front-ends so only trusted client networks and authenticated VPN users can reach them.
Enforce least-privilege permissions on SharePoint sites and disable self-service site creation for untrusted user populations until patches are applied.
Deploy a web application firewall rule that blocks request URIs and form parameters containing path traversal sequences targeting SharePoint endpoints.

bash

# Example WAF rule fragment for blocking traversal patterns on SharePoint URIs
SecRule REQUEST_URI|ARGS "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" \
    "id:1004540,phase:2,deny,status:403,log,\
    msg:'Potential CVE-2026-45454 path traversal against SharePoint'"