Microsoft Fixes Multiple Remote Code Execution Flaws Across SharePoint, Edge, Azure, and Power Pages
Microsoft published security advisories for several remote code execution vulnerabilities affecting SharePoint, Microsoft Edge (Chromium-based), Azure Orbital Spatio, Azure Virtual Network Gateway, and Microsoft Power Pages, including CVE-2026-45659, CVE-2026-45495, CVE-2026-40412, CVE-2026-40411, and CVE-2026-23652. The most detailed disclosures focused on SharePoint Server, where Microsoft described CVE-2026-35439 and CVE-2026-40357 as deserialization of untrusted data flaws that could let authenticated attackers execute arbitrary code over the network on vulnerable servers.
Microsoft rated both SharePoint issues Important with CVSS 8.8 and said exploitation requires valid access, with CVE-2026-35439 requiring at least Site Owner privileges and CVE-2026-40357 requiring Site Member permissions. The company said neither flaw had been publicly disclosed or exploited in the wild at publication and assessed exploitation as less likely, while providing fixes that also apply to both SharePoint Server 2016 and SharePoint Enterprise Server 2016. Microsoft also disclosed CVE-2026-40362, an Excel heap-based buffer overflow that can lead to remote code execution if a user opens a malicious Office file; Microsoft said the Preview Pane is not an attack vector and that a patch is available.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft issues out-of-band patch for SharePoint RCE CVE-2026-45659
Microsoft released an out-of-band fix for CVE-2026-45659, a SharePoint Server remote code execution flaw exploitable by an authenticated attacker with Site Member permissions. The vulnerability was attributed to deserialization of untrusted data and, at the time of reporting, Microsoft said there was no public exploit code or known in-the-wild exploitation.
Microsoft publishes May 21 advisories for SharePoint, Azure, and Power Pages RCE flaws
Microsoft published Security Update Guide entries for CVE-2026-45659 (Microsoft SharePoint), CVE-2026-40412 (Azure Orbital Spatio), CVE-2026-40411 (Azure Virtual Network Gateway), and CVE-2026-23652 (Microsoft Power Pages), all described as remote code execution vulnerabilities. The provided references do not include further technical or exploitation details.
Microsoft publishes Edge RCE advisory for CVE-2026-45495
Microsoft added a Security Update Guide entry for CVE-2026-45495, a remote code execution vulnerability in Chromium-based Microsoft Edge. The reference content provides no additional synopsis beyond the advisory publication.
Microsoft releases fixes for SharePoint and Excel RCE flaws
Microsoft published Security Update Guide entries for CVE-2026-35439 and CVE-2026-40357 affecting Microsoft SharePoint Server, and CVE-2026-40362 affecting Microsoft Excel. Microsoft said fixes were available and that none of the flaws were publicly disclosed or exploited in the wild at publication.
Sources
16 references tracked. Mallory keeps watching after this page renders.
SharePoint Has a New RCE Flaw. If You Haven't Patched Yet, Go Do That.
securityaffairs.com
Open sourceWarning: Microsoft SharePoint Remote Code Execution Vulnerability, Patch Immediately! | CCB Belgium
ccb.belgium.be
Open sourceMicrosoft SharePoint Server Vulnerability Enables Remote Code Execution Attacks
cybersecuritynews.com
Open sourceHigh-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659) - Help Net Security
helpnetsecurity.com
Open sourceCVE-2026-40362 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution Vulnerability
msrc.microsoft.com
Open sourceCVE-2026-35439 - Security Update Guide - Microsoft - Microsoft SharePoint Server Remote Code Execution Vulnerability
msrc.microsoft.com
Open sourceDescription of the security update for SharePoint Server Subscription Edition: March 10, 2026 (KB5002843) - Microsoft Support
support.microsoft.com
Open sourceDescription of the security update for SharePoint Server 2019: March 10, 2026 (KB5002845) - Microsoft Support
support.microsoft.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft patched multiple Exchange and SharePoint remote code execution flaws
Microsoft disclosed and patched several **remote code execution** vulnerabilities affecting **Exchange Server** and **SharePoint Server**, including Exchange flaws tracked as `CVE-2023-21706`, `CVE-2023-28310`, and `CVE-2023-36439`, alongside SharePoint issues `CVE-2026-33110`, `CVE-2026-33112`, and `CVE-2026-40368`. The SharePoint vulnerabilities were tied to **deserialization of untrusted data** and were rated **Important**, with CVSS scores of **8.8** for `CVE-2026-33110` and `CVE-2026-33112`, and **8.0** for `CVE-2026-40368`. Microsoft said `CVE-2026-33110` could let an authenticated attacker with at least **Site Member** permissions execute code remotely on a vulnerable SharePoint Server, while `CVE-2026-33112` required at least **Site Owner** privileges to inject and run arbitrary code. For `CVE-2026-40368`, exploitation involved a client connecting to a malicious server, potentially leading to code execution on the client. Microsoft reported that the SharePoint flaws were **not publicly disclosed** and **not exploited in the wild** at publication, assessed exploitation as less likely, and released fixes, including a shared KB update for **SharePoint Server 2016** and **SharePoint Enterprise Server 2016**.
May 25, 2026
Microsoft March 2026 Patch Tuesday Vulnerabilities Across SharePoint, Office/Excel, Windows Drivers, and GDI
Microsoft published security advisories for multiple **Important** and **Critical** vulnerabilities affecting *SharePoint Server*, *Microsoft Office/Excel*, Windows components, and *GDI*. The highest-impact server-side issue is **CVE-2026-26114**, a *SharePoint Server* **remote code execution** flaw attributed to **CWE-502 (deserialization of untrusted data)** with a CVSS v3.1 vector `AV:N/AC:L/PR:L/UI:N` (base score shown as 8.8), indicating network reachability with low complexity and requiring low privileges. Microsoft also disclosed **CVE-2026-26105**, a *SharePoint Server* **spoofing** issue mapped to **CWE-79 (XSS)** with `AV:N/AC:L/PR:N/UI:R` (base score shown as 8.1), implying remote exploitation that requires user interaction. On the endpoint/application side, Microsoft listed several *Office/Excel* **remote code execution** vulnerabilities: **CVE-2026-26109** (Excel RCE; **CWE-125 out-of-bounds read**; vector `AV:L/AC:L/PR:N/UI:N`, base score shown as 8.4), **CVE-2026-26108** (Excel RCE; **CWE-122 heap-based buffer overflow**; `AV:L/AC:L/PR:N/UI:R`, base score shown as 7.8), and **CVE-2026-26112** (Excel RCE; **CWE-822 untrusted pointer dereference**; `AV:L/AC:L/PR:N/UI:R`, base score shown as 7.8). Microsoft also published **CVE-2026-26113**, a **Critical** *Microsoft Office* RCE (also **CWE-822**) with `AV:L/AC:L/PR:N/UI:N` (base score shown as 8.4); one reference is a duplicate advisory page for the same CVE. Additional component advisories include **CVE-2026-24288** (Windows Mobile Broadband Driver RCE; **CWE-122**; `AV:P/AC:L/PR:N/UI:N`, base score shown as 6.8, requiring physical access) and **CVE-2026-25190** (GDI RCE; **CWE-426 untrusted search path**; `AV:L/AC:L/PR:N/UI:R`, base score shown as 7.8).
Mar 21, 2026
Microsoft Discloses Two SharePoint Remote Code Execution Vulnerabilities
Microsoft published security advisories for **CVE-2025-49704** and **CVE-2025-49701**, identifying both flaws as **Microsoft SharePoint Remote Code Execution** vulnerabilities. The entries were added to the Microsoft Security Update Guide, indicating that SharePoint deployments are affected by vulnerabilities that could allow code execution on targeted systems. The advisories provide formal tracking for two separate SharePoint RCE issues and signal that organizations running Microsoft SharePoint should review the associated update guidance and remediation information for both CVEs. The dual disclosure highlights concurrent risk in a widely used enterprise collaboration platform and raises the urgency for defenders to assess exposure across SharePoint environments.
Jun 12, 2026