The U.S. Cybersecurity and Infrastructure Security Agency has added a Microsoft SharePoint Server remote-code-execution flaw to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies until July 4 to patch on-prem SharePoint 2016, 2019 and Subscription Edition installations. The move confirms attackers are already chaining the bug in the wild.
What CVE-2026-45659 Actually Is
Tracked as CVE-2026-45659 with a CVSS score of 8.8, the vulnerability is a case of remote code execution arising from the deserialization of untrusted data. Microsoft addressed it in May 2026 for SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Enterprise Server 2016, noting that any authenticated attacker could trigger the flaw without admin or elevated privileges.
Microsoft's own advisory tagged the issue Exploitation Less Likely at release, which now looks optimistic. Any authenticated network-based attacker with a minimum of Site Member permissions can leverage the deserialization to execute code remotely on the SharePoint server, according to Microsoft's guidance.
Storm-2603 And A Second Actor In The Same Network
Late last month Microsoft published a rare joint intrusion analysis showing two unrelated threat actors operating inside the same victim network. One set of attacks is attributed to Storm-2603, the group behind Warlock ransomware, which has been exploiting known SharePoint bugs since mid-2025. Initial access in the newly documented case is likely to have come through a separate flaw, with probing for files like win.ini and web.config pointing to CVE-2025-11371 in Gladinet Triofox.
Storm-2603 then deployed Velociraptor to blend malicious activity with trusted admin traffic, opened remote access channels via Cloudflare tunnels, Zoho Assist and SSH over Visual Studio Code, and abused the NSecKrnl.sys vulnerable driver to blind endpoint protection. A second, unrelated actor ran DLL side-loading and custom backdoors alongside, making attribution and eviction that much harder.
Patch Ranks Among The Hottest Enterprise Bugs Of The Summer
The KEV listing puts SharePoint on the same tier as recent enterprise crises like the Chrome 151 zero-day storm and Adobe's ColdFusion CVSS 10 flaws. Enterprises running unpatched on-prem SharePoint should treat this as immediate remediation, especially where the server is exposed to authenticated users beyond a small admin group. It arrives the same week as the Bad Epoll Linux kernel escalation, keeping defenders busy.
Reporting based on coverage from The Hacker News, CISA and Microsoft Security Response Center.