Microsoft has released patches for a high-severity remote code execution vulnerability (CVE-2026-45659) in SharePoint that may be exploited in low-complexity attacks.
It affects the SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.
CVE-2026-45659 stems from Shareoint deserializing untrusted data, and may be exploited by an authenticated attacker to execute code remotely on a vulnerable SharePoint Server instance – no user interaction required.
“The attack complexity is Low (AC:L) because an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component,” Microsoft explained.
In order to exploit it, though, attackers must first successfully authenticate to the server.
SharePoint servers are an attractive target for attackers as they often hold sensitive company data and are usually accessible from the internet.
SharePoint has had several critical, actively exploited vulnerabilities over the years, including remote code execution flaws that required no authentication, minimal (such as those required to exploit CVE-2026-45659), or even high privileges .
Deployments have been targeted by nation-state hackers, ransomware operators, and initial access brokers.
Though Microsoft deems CVE-2026-45659 less likely to be exploited, and there is currently no public details about it or a PoC exploit for it, organizations with on-prem SharePoint servers “should still treat this as a material update,” and implement it sooner rather than later.
The vulnerability has been fixed in:
UPDATE (May 27, 2026, 03:20 a.m. ET):
Microsoft has updated the advisory to say that CVE-2026-45659 was addressed by updates that were released in May 2026, but the CVE was inadvertently omitted from the May 2026 Security Updates.
“Customers who have already installed the May 2026 updates do not need to take any further action,” the company added.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。