Deserialization flaw in Microsoft SharePoint Server (CVE-2026-45659) — authenticated remote code execution, with a 3-day remediation deadline
Microsoft SharePoint Server, the widely used document-collaboration platform, contains a deserialization-of-untrusted-data vulnerability that lets an authorized attacker execute code over the network. CISA added it to the KEV (Known Exploited Vulnerabilities) catalog on July 1, 2026, setting the remediation deadline just three days later, on July 4.
Key facts
- CVE IDCVE-2026-45659
- CVSS base score8.8 HIGH
- CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Affected (vendor / product)Microsoft SharePoint Server
- CWECWE-502
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-07-04 (U.S. federal civilian agencies, BOD 22-01)
Key points
- Deserialization of untrusted data (CWE-502) in SharePoint Server — crafted data injected into the restore process can execute code remotely
- Requires authorization (login) — the classic post-intrusion pattern: a stolen account or existing foothold becomes full server takeover
- Microsoft's NVD-registered assessment: CVSS 8.8 (HIGH) — low privileges, no user interaction
- Added to KEV July 1, 2026; remediation due July 4 — a 3-day, top-priority deadline under BOD 26-04
- Response: apply Microsoft's guided patches/mitigations (on-premises deployments)
Deserialization is the process of restoring data that was "serialized" for transport over networks or files back into live program objects. If the incoming data is not properly validated, an attacker can plant components in crafted data that spring to life the moment they are restored — leading to remote code execution.
It is a classic and often fatal vulnerability class that has surfaced repeatedly in .NET-based server products, SharePoint included.
This flaw requires an "authorized attacker" — some form of login — so it cannot be hit cold from the outside. In real intrusions, however, the standard play is to use a phished user account or a foothold from another vulnerability, then use exactly this kind of authenticated RCE to seize the server itself and pivot laterally.
SharePoint concentrates documents, HR files, and project data, so the quality of the damage after takeover is severe.
The striking detail is the deadline: three days from KEV addition (July 1) to remediation (July 4) marks top-priority treatment under CISA's new BOD 26-04 risk-based directive and signals strong concern about spreading exploitation.
On-premises SharePoint Server deployments are the target; patching per Microsoft's update guide is the baseline, and given SharePoint's on-prem exploitation history, it is also a good moment to revisit whether external exposure is needed at all.
Why it matters
A SharePoint takeover directly enables both data theft and lateral movement, since it is the hub of organizational documents. The unusually short 3-day deadline reflects how seriously active exploitation is viewed. On-prem operators should patch and re-examine external exposure — and treat "authenticated RCE" as a first-class threat, not a lesser one.
FAQ
What is a deserialization vulnerability?
If login is required, is the risk lower?
What should I do?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).