CVE Tools
Track your stack

CISA: Microsoft SharePoint RCE flaw now actively exploited

BleepingComputerBy Sergiu Gatlan

Reported exploitedMicrosoft SharePoint Server

Our summary

CISA says attackers are now actively using a high-severity remote code execution weakness in Microsoft SharePoint, tracked as CVE-2026-45659. The issue is caused by unsafe deserialization of untrusted data and can let authenticated attackers with minimal permissions run arbitrary code on unpatched SharePoint servers via low-complexity, network-based attacks. Microsoft has released fixes for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, and CISA has added CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to patch by the applicable deadline.

Read at BleepingComputer

BleepingComputer publishes this story on its own site; we link to it rather than reprint it.

  1. BleepingComputerHackers target Microsoft SharePoint RCE chain with PoC exploitCVE-2026-45659
  2. BleepingComputerCISA: Windows Task Host flaw now exploited by ransomware gangsCVE-2026-45659
  3. SecurityWeekSharePoint Vulnerability Exploited Shortly After PoC ReleaseCVE-2026-45659
  4. BleepingComputerHackers leverage new Microsoft SharePoint exploit in attacksCVE-2026-45659
  5. BleepingComputerCISA: Microsoft SharePoint flaw now exploited in ransomware attacksCVE-2026-45659
  6. SecurityWeekFourth SharePoint Vulnerability Exploited in Past Month’s Wave of AttacksCVE-2026-45659
  7. The Hacker NewsCritical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoCCVE-2026-45659
  8. The Hacker NewsCISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEVCVE-2026-45659
  9. SecurityWeekCISA Urges Immediate Patching of Exploited SharePoint VulnerabilitiesCVE-2026-45659
  10. The Hacker NewsResearcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch TuesdayCVE-2026-45659

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store