Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-45659, CWE-502)

1. Apply Official Security Patches

Immediately apply the latest Cumulative Updates (CU) and security updates provided by Microsoft.

• Refer to the Microsoft MSRC Update Guide to download and install the appropriate patches for your environment.

2. Temporary Mitigations

If immediate patching is not feasible, implement the following workarounds:

• Enforce Least Privilege: Review and restrict user privileges within the SharePoint environment to minimize the attack surface.
• Network Segmentation: Restrict network access to SharePoint servers to trusted internal IP ranges and block direct access from the public internet.
• WAF & IPS Signatures: Update Web Application Firewall (WAF) and Intrusion Prevention System (IPS) rules to detect and block known .NET deserialization attack patterns.

This vulnerability (CVE-2026-45659) is a deserialization of untrusted data vulnerability (CWE-502) residing in Microsoft SharePoint Server.

An attacker with basic authenticated access to the SharePoint network can exploit this by sending a specially crafted serialized payload to the server. When the server deserializes this untrusted input without proper validation, it triggers arbitrary code execution under the security context of the SharePoint service account.

With a CVSS 3.1 score of 8.8 (High) and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability represents an active threat with high exploitation probability (EPSS).