CISA Adds Actively Exploited SharePoint RCE CVE-2026-45659 to KEV, Giving Federal Agencies Three Days to Patch
A deserialization flaw in on-premises SharePoint, patched in May, is now confirmed under active exploitation, with a July 4 federal deadline.
Editor's Note ·
- Clarification:
- Two of the article's four cited sources — vulnerability.circl.lu (CIRCL Vulnerability-Lookup) and cyberpress.org (Cyber Press) — are not on The Machine Herald's source allowlist. Both are recognized security-information outlets; this note flags the allowlist-coverage gap for transparency and does not indicate a factual problem.
- Clarification:
- The Cyber Press source (https://cyberpress.org/cisa-microsoft-sharepoint-rce/) returned HTTP 403 during automated capture, so no snapshot of it was archived in the provenance chain. The two facts the article attributes to Cyber Press — the July 1 KEV addition with a July 4 remediation deadline, and the ransomware-use status of 'Unknown' — were independently verified against the captured SOCRadar snapshot; no claim rests solely on the unarchived source.
Overview
The U.S. Cybersecurity and Infrastructure Security Agency has added a Microsoft SharePoint remote code execution flaw, CVE-2026-45659, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. According to SOCRadar, CISA added the vulnerability to the KEV catalog on July 1, 2026 and set a remediation due date of July 4, 2026 for federal civilian agencies. Cyber Press reports the same July 1 addition and July 4 deadline.
What We Know
The flaw is a remote code execution bug caused by unsafe deserialization of untrusted data. As recorded in the CIRCL Vulnerability-Lookup entry, Microsoft’s advisory describes it as “Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.” The same entry classifies it under CWE-502 (deserialization of untrusted data) and assigns a CVSS v3.1 base score of 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. SOCRadar and Security Affairs also list the score as 8.8.
Exploitation does not require administrative access. According to SOCRadar, exploitation can be performed by an authenticated attacker with minimal “Site Member” permissions, and the vector’s PR:L rating reflects that only low privileges are required. Security Affairs likewise reports that Site Member permissions are sufficient and that no admin rights are needed.
The vulnerability affects on-premises deployments across three product lines. The CIRCL Vulnerability-Lookup entry lists SharePoint Enterprise Server 2016 below build 16.0.5552.1002, SharePoint Server 2019 below build 16.0.10417.20128, and SharePoint Server Subscription Edition below build 16.0.19725.20280 as affected; SOCRadar lists the same three editions and build thresholds. The fix is not new: the same CIRCL record shows a published date of May 22, 2026, and SOCRadar reports Microsoft addressed the flaw in May 2026. The KEV listing therefore reflects exploitation of a bug that had a patch available for weeks before it was confirmed to be under attack.
The flaw was credited to a researcher using the moniker “MEOW,” according to Security Affairs.
What We Don’t Know
The public record does not yet identify the attackers or the full attack chain. SOCRadar states that public reporting has not clarified who is exploiting the flaw or the full exploitation chain. Nor has a ransomware connection been established: Cyber Press reports that CISA has not confirmed whether CVE-2026-45659 has been leveraged in ransomware campaigns, marking that status as “Unknown.”
Analysis
On-premises SharePoint remains a high-value target for this class of bug. Cyber Press frames CVE-2026-45659 as a serious remote code execution risk for on-premises SharePoint deployments, and the low bar to abuse it — a single authenticated account with basic site membership — widens the pool of potential attackers well beyond privileged insiders.
The compressed remediation window is itself notable. A three-day federal deadline, from the July 1 KEV addition to the July 4 due date, matches the fastest tier of CISA’s risk-based patching model. As previously reported, the agency’s Binding Operational Directive 26-04 made a three-day clock standing policy for the worst-case combination of an internet-exposed, actively exploited flaw. An authenticated RCE in on-premises SharePoint that already sits on the KEV catalog is precisely the kind of case that framework was built to escalate.