CISA added CVE-2026-45659 to KEV on 1 July 2026. Its record describes SharePoint Server deserialization of untrusted data that allows an authorised attacker to execute code over a network.
Key takeaways
- The catalog records known ransomware campaign use as known.
- Verify the vendor update and decide whether the deployment's exposure and authentication model require a prior-compromise investigation.
SharePoint is often integrated with identity, document workflows and line-of-business applications. Its security posture depends on the actual deployment, authentication controls and external reachability.
This is a dated public-source analysis, not a claim of current exploitation against a specific SharePoint estate.
What the sources establish
CISA records the CVE, its date of addition and its high-level consequence. Microsoft's Security Response Center is the source for affected versions and update instructions.
Defensive checks
Inventory on-premises SharePoint Server roles, confirm patch state against Microsoft guidance, restrict unnecessary exposure, and preserve web and application logs. Where the system was exposed, review suspicious administrator activity and unexpected process or configuration changes.
Sources
Version confirmation and investigation scope should be based on the actual deployment, not a generic severity label.
Editorial feedback
Have a correction or additional primary evidence? Contact the editorial team and include this article’s URL.