Provenance Record

Clean, well-structured News piece. Uses a neutral 'What We Know / What We Don't Know / Analysis' frame appropriate for an ongoing vulnerability advisory. 518 words, within the News 400-1200 range. Every claim is attributed inline to a specific source. Deliberately reports only the disclosed advisory facts (identifier, dates, affected builds, exploitation status) without any exploit code or step-by-step attack mechanics.

Read all three captured snapshots from disk (uncompressed sha256 of each matches the manifest exactly). source-0.html.gz (CIRCL Vulnerability-Lookup, HTTP 200): CONFIRMS CVE-2026-45659, the verbatim Microsoft advisory quote 'Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network', CWE-502, CVSS v3.1 base 8.8 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, the three affected editions (Enterprise Server 2016 < 16.0.5552.1002, Server 2019 < 16.0.10417.20128, Subscription Edition < 16.0.19725.20280), and Published: 2026-05-22. source-1.html.gz (SOCRadar, HTTP 200): CONFIRMS KEV add date July 1, 2026, remediation due date July 4, 2026, CVSS 8.8, authenticated attacker with minimal 'Site Member' permissions, the identical three editions/build thresholds, Microsoft fix shipped in May 2026, the 'who is exploiting the flaw or the full exploitation chain' has not been clarified statement, and the ransomware status marked 'Unknown'. source-2.html.gz (Security Affairs, HTTP 200): CONFIRMS CVE-2026-45659, CVSS 8.8, authenticated attacker with a minimum of 'Site Member permissions (PR:L)', and the researcher moniker 'MEOW'. source-3 (Cyber Press, https://cyberpress.org/cisa-microsoft-sharepoint-rce/) returned HTTP 403 (bot-blocked) so NO snapshot was captured; I did not re-WebFetch it. Both claims the article attributes to Cyber Press — the July 1 add / July 4 deadline and the ransomware 'Unknown' status — are independently corroborated verbatim in the verified SOCRadar snapshot, so the article's factual record stands on captured sources.

All specifics verified against snapshots: CVE ID, KEV-add date (July 1), patch deadline (July 4), and the 'three days' math check out (July 1 -> July 4 = 3 days, matching the fastest tier of BOD 26-04 as the article notes). CVSS score and vector, CWE, affected builds, patch date (May 22 / May 2026), and the MEOW attribution are all supported. No hallucinated quotes: the one direct quote (the Microsoft advisory sentence) is verbatim in CIRCL. The 'no admin rights are needed' phrasing is a fair paraphrase of Security Affairs' 'minimum of Site Member permissions (PR:L)' (low-privilege, not admin).

APPROVE_WITH_CORRECTIONS. Every factual claim, quote, date, and specific is verified against the captured snapshots; the headline, summary, and lead are fully sourced and the deadline math is correct. The only issues are the two automated source-access warnings (two off-allowlist domains and one bot-blocked Cyber Press snapshot). No factual error exists, but a public corrections note transparently records the source-archival limitation for the provenance trail, per the automated recommendation.