CVE-2026-45659

HighActively exploited (CISA KEV)Known to be used in ransomware campaigns

Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

SeverityHigh

CVSS8.8

Exploit probability—

Product

Microsoft SharePoint Server

PublishedMay 22, 2026

First seenMay 22, 2026

Added to KEVJul 1, 2026

Weakness typeCWE-502Deserialization of untrusted data

How to fix

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA due date: Jul 4, 2026

Update

microsoft sharepoint_server16.0.19725.20280 or later

Patches

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659

Affected products

Product	Affected versions	Fixed in
microsoft sharepoint_server	v < 16.0.19725.20280, 2016, 2019	16.0.19725.20280

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.