SharePoint Is Burning: CVE-2026-45659 and the Federal Patch Deadline That Already Passed

Published: July 5, 2026

The Vulnerability

Microsoft SharePoint Server contains a remote code execution flaw — CVE-2026-45659 — that allows an unauthenticated attacker to execute arbitrary code through deserialization of untrusted data. CVSS score: 8.8. This isn't theoretical. CISA added it to the Known Exploited Vulnerabilities catalog this week because threat actors are already using it.

  • CVE ID: CVE-2026-45659
  • Affected Product: Microsoft SharePoint Server (multiple versions)
  • Vulnerability Type: Remote Code Execution (RCE) via Unsafe Deserialization
  • CVSS Score: 8.8 (High)
  • Status: Actively Exploited in the Wild
  • Federal Deadline: July 4, 2026 (issued by CISA for Federal Civilian Executive Branch agencies)

Why This Matters

SharePoint isn't some niche product. It's the document-management backbone for:

  • Government agencies (federal, state, local)
  • Large enterprises (finance, healthcare, manufacturing)
  • Any organization that needs centralized file storage, collaboration, and workflow automation

An unauthenticated attacker means no credentials required. Walk up to a vulnerable SharePoint instance over the network, send a crafted request, and you own the server. From there: steal files, plant backdoors, move laterally into the network, exfiltrate data, deploy ransomware.

This is not a hypothetical. CISA doesn't add vulnerabilities to KEV because maybe someone might exploit them. They add them because the exploitation is happening.

What CISA Told Federal Agencies (and Why You Should Listen)

On July 4, CISA issued a binding directive to all Federal Civilian Executive Branch agencies: patch by July 4. Not by end of month. Not by the next quarterly maintenance window. By July 4.

If you're a government contractor, subcontractor, or vendor serving FCEB, this applies to you. If you're a private organization running SharePoint? The directive doesn't legally apply — but the threat absolutely does. The same attackers don't stop at the federal perimeter.

The Mechanics

The vulnerability hinges on unsafe deserialization — the act of converting serialized data (often from an HTTP request) back into executable objects without validating that data first. In SharePoint's case, an attacker can craft a malicious serialized object that, when deserialized by the server, triggers code execution.

This is a pattern we've seen before. It's old. It's well-understood. And yet it keeps appearing because developers and architects still treat deserialization as a safe operation if the request comes from "inside" the network. Spoiler: it's not safe. An unauthenticated attacker doesn't need to be inside anything; the vulnerability is exposed to the network itself.

What You Do Now

If you run SharePoint:

  1. Verify your version. Microsoft has released patches. Get the exact CVE details from Microsoft's official advisory and cross-reference your installed version.
  2. Patch immediately. Not this month. Not after your next change board. Now. This is active exploitation.
  3. In the interim: If patching takes time (it shouldn't, but it might), implement network segmentation and access controls that restrict SharePoint access to authorized users/systems only. Monitor for suspicious requests.
  4. Scan for indicators of compromise. Has anyone accessed your SharePoint in the last few weeks with unauthenticated RCE attempts? Check your logs. If you see serialized payloads, malformed requests, or unexpected file access patterns, assume breach and escalate.

If you don't run SharePoint but your organization does:

  1. Talk to whoever owns it. Not in a Slack message. In person or on the phone. "Is SharePoint patched?" If the answer isn't "yes, as of [date]," escalate.
  2. Know what data lives there. Trade secrets? Customer records? Health information? Credentials? If you can't answer, you're not ready.

If you're a government contractor or vendor:

Your federal customers are almost certainly going to audit this in the coming weeks. Have a patch date. Have evidence. Have a plan for clients who lag.

Context: CISA's Other Recent KEV Additions

This isn't the only vulnerability in active exploitation right now. CISA also added:

  • Splunk Enterprise (CVE pending): Authentication bypass in the PostgreSQL sidecar. An unauthenticated attacker can create or truncate arbitrary files.
  • SimpleHelp: OIDC authentication bypass. Forged identity tokens allow full authenticated access.
  • Oracle PeopleSoft Enterprise PeopleTools: Missing authentication on critical functions, leading to complete takeover.

If you run any of these, same story: patch, verify, monitor. The gap between "CISA adds to KEV" and "your organization gets hit" is measured in days, not weeks.

The Accountability Question

Why is this conversation still happening in 2026? Deserialization vulnerabilities aren't new. Unsafe object instantiation isn't a surprise. The techniques to exploit and prevent them are decades old.

Microsoft's response time here (patches available, CISA added to KEV) is responsible. But the underlying fact — that a widely-deployed enterprise product is vulnerable to unauthenticated RCE through a mechanism we've been warning about since Java and .NET's early days — reflects a culture where "ship it and patch later" still wins over "don't deserialize untrusted input."

That culture costs organizations millions in breach remediation, ransom payments, and downtime. It costs people their privacy and their job security. It costs governments the integrity of their communications.

Until shipping a patch is considered more urgent than shipping a feature, vulnerabilities like CVE-2026-45659 will keep appearing.

Sources