Deserialization flaw in Microsoft SharePoint Server (CVE-2026-45659) — authenticated remote code execution, with a 3-day remediation deadline
Microsoft SharePoint Server, the widely used document-collaboration platform, contains a deserialization-of-untrusted-data vulnerability that lets an authorized attacker execute code over the network. CISA added it to the KEV (Known Exploited Vulnerabilities) catalog on July 1, 2026, setting the remediation deadline just three days later, on July 4.
Key facts
- CVE IDCVE-2026-45659
- CVSS base score8.8 HIGH
- CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Affected (vendor / product)Microsoft SharePoint Server
- CWECWE-502
- ExploitationListed in CISA KEV (exploitation confirmed); also confirmed used in ransomware
- Remediation due2026-07-04 (U.S. federal civilian agencies, BOD 22-01)
Key points
- Deserialization of untrusted data (CWE-502) in SharePoint Server — crafted data injected into the restore process can execute code remotely
- Requires authorization (login) — the classic post-intrusion pattern: a stolen account or existing foothold becomes full server takeover
- Microsoft's NVD-registered assessment: CVSS 8.8 (HIGH) — low privileges, no user interaction
- Added to KEV July 1, 2026; remediation due July 4 — a 3-day, top-priority deadline under BOD 26-04
- Response: apply Microsoft's guided patches/mitigations (on-premises deployments)
- Post-login RCE is used from a foothold gained by phishing or another vulnerability — the standard play.
1What deserialization is
Deserialization is the process of restoring data that was "serialized" for transport over networks or files back into live program objects. If the incoming data is not properly validated, an attacker can plant components in crafted data that spring to life the moment they are restored — leading to remote code execution.
It is a classic and often fatal vulnerability class that has surfaced repeatedly in .NET-based server products, SharePoint included.
2The authorized attacker condition
This flaw requires an "authorized attacker" — some form of login — so it cannot be hit cold from the outside. In real intrusions, however, the standard play is to use a phished user account or a foothold from another vulnerability, then use exactly this kind of authenticated RCE to seize the server itself and pivot laterally.
SharePoint concentrates documents, HR files, and project data, so the quality of the damage after takeover is severe.
3What the short remediation deadline signals
The striking detail is the deadline: three days from KEV addition (July 1) to remediation (July 4) marks top-priority treatment under CISA's new BOD 26-04 risk-based directive and signals strong concern about spreading exploitation.
On-premises SharePoint Server deployments are the target; patching per Microsoft's update guide is the baseline, and given SharePoint's on-prem exploitation history, it is also a good moment to revisit whether external exposure is needed at all.
4Remote code execution presupposing a login
The condition here is an authorised attacker — some login is required, so not anyone from outside can strike directly. In real attacks, though, that premise gets met.
Taking a general user account by phishing, or a foothold from another vulnerability, and then using this kind of post-login RCE to take the server and move laterally is the established pattern. SharePoint is where documents, personnel material and project information gather, which makes the quality of the damage heavy when it is taken.
Why it matters
A SharePoint takeover directly enables both data theft and lateral movement, since it is the hub of organizational documents. The unusually short 3-day deadline reflects how seriously active exploitation is viewed. On-prem operators should patch and re-examine external exposure — and treat "authenticated RCE" as a first-class threat, not a lesser one.
FAQ
What is a deserialization vulnerability?
If login is required, is the risk lower?
What should I do?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).