CVE-2026-45659: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-45659 Overview

CVE-2026-45659 is a deserialization vulnerability in Microsoft Office SharePoint Server that allows an authenticated attacker to execute arbitrary code over a network. The flaw is classified under [CWE-502] Deserialization of Untrusted Data. An attacker with low-level privileges on a vulnerable SharePoint Server can submit crafted serialized payloads that the server deserializes without sufficient validation. Successful exploitation grants code execution in the context of the SharePoint application, exposing site content, credentials, and connected backend systems. Microsoft has published guidance through the Microsoft Security Update Guide.

Critical Impact

Authenticated network attackers can achieve remote code execution on SharePoint Server, compromising confidentiality, integrity, and availability of hosted content.

Affected Products

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

• 2026-05-22 - CVE-2026-45659 published to the National Vulnerability Database
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45659

Vulnerability Analysis

The vulnerability resides in SharePoint Server's handling of serialized objects supplied through network-accessible interfaces. SharePoint processes serialized data submitted by authenticated users and reconstructs .NET objects without enforcing strict type allow-lists. An attacker abuses this behavior by submitting a gadget chain that triggers code execution during the deserialization process. Because SharePoint runs with elevated service privileges, the executed code typically inherits broad access to site collections, content databases, and integrated services.

The scope of impact extends beyond the SharePoint farm. SharePoint is frequently integrated with Active Directory, Office Online Server, and SQL Server, providing lateral movement opportunities post-exploitation. The EPSS score of 0.621 percent reflects current exploitation prediction modeling, but historical SharePoint deserialization flaws (such as ToolShell variants) have seen rapid weaponization once technical details surface.

Root Cause

The root cause is unsafe deserialization of attacker-controlled input within a SharePoint server component. Microsoft has not publicly disclosed the specific endpoint or type resolver involved. The pattern aligns with [CWE-502], where deserializers reconstruct arbitrary types referenced in serialized payloads, enabling gadget chains that execute code as a side effect of object construction.

Attack Vector

The attack vector is network-based and requires the attacker to hold an authenticated SharePoint account with low privileges. No user interaction is required. The attacker sends a crafted HTTP request containing a malicious serialized object to a SharePoint endpoint that performs deserialization. The deserialization process instantiates a chain of objects that ultimately invokes a command execution primitive within the SharePoint worker process.

No public proof-of-concept code is available for CVE-2026-45659 at the time of publication. Refer to the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-45659

Indicators of Compromise

• Unexpected w3wp.exe child processes such as cmd.exe, powershell.exe, or csc.exe originating from SharePoint application pool identities.
• New or modified .aspx files in SharePoint LAYOUTS directories (%ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS).
• POST requests to SharePoint endpoints containing base64-encoded BinaryFormatter or LosFormatter payload markers.
• Outbound network connections from SharePoint servers to unknown external IP addresses immediately following authenticated requests.

Detection Strategies

• Monitor IIS logs for authenticated POST requests with abnormally large body sizes targeting SharePoint handler URLs.
• Hunt for Windows Event ID 4688 entries showing process creation from w3wp.exe with command interpreters or script hosts as children.
• Inspect SharePoint ULS logs for deserialization exceptions and type-load failures that may indicate exploitation attempts.

Monitoring Recommendations

• Enable PowerShell Script Block Logging (Event ID 4104) on all SharePoint front-end and application servers.
• Forward IIS, ULS, and Sysmon telemetry to a centralized analytics platform for correlation against known SharePoint exploitation patterns.
• Alert on any modifications to SharePoint web.config, LAYOUTS, or _vti_bin directories outside of approved change windows.

How to Mitigate CVE-2026-45659

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all SharePoint Server 2016, 2019, and Subscription Edition deployments.
• Audit SharePoint user accounts and remove unused or excessive permissions, particularly accounts with site contribution rights.
• Restrict SharePoint administrative endpoints to trusted internal networks via firewall or reverse proxy rules.
• Rotate machine keys and service account credentials after patching to invalidate any payloads staged by attackers pre-patch.

Patch Information

Microsoft has released security updates addressing CVE-2026-45659 for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Administrators should consult the Microsoft Security Update Guide for the specific KB articles and deployment guidance for each supported version. Apply updates to all servers in the farm and run the SharePoint Products Configuration Wizard or PSConfig.exe afterwards.

Workarounds

• Enforce Antimalware Scan Interface (AMSI) integration for SharePoint Server, which inspects content during request processing.
• Disable or restrict access to non-essential SharePoint web services and custom handlers exposed to authenticated users.
• Place SharePoint behind a Web Application Firewall configured to inspect serialized payload signatures and oversized POST bodies.

# Verify SharePoint patch level after installation
Get-SPFarm | Select-Object BuildVersion
Get-SPProduct -Local | Format-List ProductName, PatchableUnitDisplayName, PatchableUnitVersion