The Stealthy SharePoint RCE: Why Your Patching Strategy Must Change
Another month, another emergency, and a frantic race against the clock. Microsoft has just dropped an out-of-band security fix for SharePoint Server, and this one has teeth. If you're patching regularly, you know the drill, but this isn't your standard, run-of-the-mill maintenance window. CVE-2026-45659 is a classic case of bad design meeting high-value data—a potent, dangerous combination. It's an RCE—remote code execution—and if you're running SharePoint on-premises, your window to fix this is practically zero.
No, this isn't just a "someday" patch. This is a "patch it now, do it tonight" situation. Why? Because the barrier to entry is ridiculously low, and the environment it compromises is, for many, the very heart of their internal operations. We're not talking about some obscure service that you can disable while waiting for the next cycle. We're talking about the platform that holds your documents, your workflows, and your internal collaboration. And right now, it's vulnerable to any authenticated attacker.
That's the real kicker. You don't need to be a nation-state actor with a zero-day exploit chain to leverage this. You just need a standard employee credential. If that doesn't set off alarms in your Security Operations Center, I don't know what will. It's time to stop treating these patches as optional chores and recognize them for what they are: the thin blue line between an operational environment and a digital disaster.
The Mechanics: When Deserialization Goes Wrong
At its heart, this vulnerability, CVE-2026-45659, pivots on a fairly fundamental—and frequently misused—concept: unsafe deserialization in Microsoft.SharePoint.Library.
To simplify it: your SharePoint server takes data, often from users, and it has to convert that data into an object processable by the server. That's the deserialization step. If the server doesn't rigorously check the content of that data before it turns it into an object, you're in trouble. Specifically, the flaw stems from how the LosFormatter.Deserialize method is used within the SPListItem.Update() function.
This isn't just a simple case of input validation missing a field. It's much deeper. The platform is instructed to reconstruct a complex object from a serialized string, and the system fails to apply the necessary cryptographic or type-safe verification constraints.
When a user interacts with custom field types—think of those as special metadata structures you use for organizing list items—and attempts to update a list item, the system processes what essentially looks like viewstate data. Because the LosFormatter is used without adequate filtering or type constraints, an attacker who can input their own data—which is essentially any authenticated user—can force the SharePoint service to deserialize untrusted, maliciously crafted objects.
It's like handing a blank checkbook to someone and hoping they'll only write checks for small amounts, without actually verifying the check itself. By passing crafted input into the Update() method, an attacker hijacks the deserialization process. This bypasses the typical checks you'd expect from a robust enterprise platform. Because the object reconstruction process itself is compromised, the attacker can dictate the execution flow of the application. It creates an arbitrary code execution vector under the privileges of the SharePoint service account—which, as we know, is already far too high to be left to its own devices.
The Low-Barrier, High-Hazard Reality
What makes this particularly dangerous—and why I keep harping on the "patch now" aspect—is the incredibly low barrier to entry. Security research indicates that this does not require administrative privileges.
Authentication is the only real hurdle. A user with "Contribute" or "Site Member" permissions—the very people who are using SharePoint to collaborate every single day—already has all the access they need to exploit this flaw. They can trigger this over HTTPS using standard REST or CSOM interface calls.
Think about the implications. You don't need a stolen admin password here. You don't need to break in through the firewall. You just need a standard employee account with basic site-level permissions. If your company has a compromised employee laptop, or a disgruntled insider—both of whom already have access to the collaboration environment—they suddenly have a very sharp weapon.
They can remotely execute code on the core SharePoint server hosting your critical documents, proprietary data, and workflows. Once they have that foothold, they move laterally, they escalate, they do the damage they came to do. And all of it via standard, expected SharePoint interactions. This ease of exploitation is precisely what makes it so attractive to automated scanning and opportunistic attackers. They don't have to brute-force anything; they just have to look like an ordinary user.
SharePoint: The Gravity Well of Enterprise Data
There's a reason vulnerabilities in SharePoint get so much attention. SharePoint, particularly on-premises, is the gravity well of much of an enterprise's digital activity. It's not just a file server; it's the glue holding together Active Directory, Microsoft Outlook integration, Teams collaboration, and custom enterprise workflows. It's the central hub for data access and information flow.
It's a high-value target precisely because of how well-integrated it is. When an on-premises SharePoint server falls, the door often opens to much, much more. An attacker isn't just accessing the SharePoint platform; they are potentially gaining a launchpad to the entire organization's Active Directory domain, to sensitive data across multiple integrated services, and to the backbone of internal communications.
We've seen this time and again. Nation-state actors have a historical affinity for targeting these kinds of enterprise collaboration nodes. Ransomware operators are increasingly exploiting such vulnerabilities to gain the initial access they need to encrypt environments and demand ransoms. These attackers don't just randomly hit servers; they target SharePoint because it's there, it's critical, and when compromised, it's incredibly valuable.
The July 2025 "ToolShell" incident is a sobering reminder of the risk, where vulnerabilities in on-premises SharePoint were part of a chain that effectively allowed attackers to compromise critical government and national security infrastructure. CVE-2026-45659 echoes these risks perfectly. When you consider the vast amounts of intellectual property, sensitive communications, and process workflows that reside in on-premises SharePoint, this vulnerability isn't just a patch management task—it's a critical strategic defensive priority.
CISA Confirms Active Exploitation: KEV Inclusion and Federal Mandate
As of July 2, 2026, the situation has escalated from theoretical risk to confirmed active exploitation. CISA has added CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) catalog, confirming that threat actors are actively weaponizing this flaw in the wild. The agency has issued Binding Operational Directive (BOD) 26-04, ordering all Federal Civilian Executive Branch (FCEB) agencies to patch their SharePoint servers by Saturday.
"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," CISA warned. "Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines."
BOD 26-04, issued last month, requires federal agencies to prioritize patching based on four criteria: whether the flaw appears in CISA's KEV catalog, whether exploitation can be automated for large-scale attacks, whether the asset is publicly exposed online, and whether successful exploitation grants attackers partial or total control of the targeted device. CVE-2026-45659 checks every box.
The vulnerability was accidentally omitted from Microsoft's May 2026 Security Updates and addressed only in an out-of-band release on May 21. This delay gave attackers additional time to develop and deploy exploits before the patch even existed.
Shadowserver is currently tracking over 10,000 SharePoint servers exposed online to the internet. There is no confirmed data on how many of these have been patched against CVE-2026-45659, leaving a massive attack surface for automated scanning tools and opportunistic threat actors.
Since 2021, CISA has tagged 11 Microsoft SharePoint vulnerabilities that have been abused in the wild, with seven of them also exploited in ransomware attacks. The pattern is clear: SharePoint remains a persistent high-value target for both nation-state actors and criminal ransomware groups alike.
The Defensive Imperative: Act, or Pay the Price
The reality of this discovery is simple: if you are running on-premises SharePoint Server—versions 2016, 2019, 2022, or the Subscription Edition—this vulnerability affects you.
The remedy is already here, but it requires immediate deployment. Because Microsoft released this as an out-of-band update, it skips the normal patch cycle cadence. This is because they recognized the severity and the high probability of exploitation. The risks are just too high to wait.
Don't wait for your next maintenance window. The standard procedure—testing, staging, and then production—should be accelerated. If you don't take action, you leave this door wide open. Review your SharePoint server inventory, identify your on-premises deployments, and prioritize the installation of this emergency patch.
For organizations with internet-exposed SharePoint servers, consider temporary network segmentation or disabling external access until patching is complete. Monitor for indicators of compromise consistent with SharePoint RCE exploitation, including unusual process execution on SharePoint servers and unexpected outbound network connections.
In the landscape of cyber conflict, especially against adversaries with the persistence and tactical skill level of those targeting platforms like SharePoint, failing to act on a known RCE is exactly the weakness they are looking for. Patch, test, and protect your environment immediately. This is not the time for delay; this is the time for decisive, swift action to secure the integrity of your collaboration environment.