Loading story…
CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalog after confirming active attacks against Microsoft SharePoint Server. The high-severity flaw is a deserialization of untrusted data issue that lets an authenticated attacker with only Site Member permissions execute arbitrary code on vulnerable, internet-exposed servers, with no user interaction required and low attack complexity. Microsoft said the bug is easy to exploit with repeatable success and released fixes in late May after the CVE was initially omitted from its May 2026 security updates.
The vulnerability affects SharePoint Server Subscription Edition, SharePoint Server 2019, SharePoint Server 2016, and SharePoint Enterprise Server 2016. CISA ordered Federal Civilian Executive Branch agencies to remediate the issue within days under BOD 26-04, while internet scanning data cited by Shadowserver shows more than 10,000 SharePoint servers remain exposed online. Separately, Microsoft disclosed a ransomware investigation involving Storm-2603 and another threat actor operating in the same compromised environment, where the attackers used persistence, remote access tools, privilege escalation, and defense evasion after initial access was likely obtained through CVE-2025-11371 in Gladinet Triofox.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Following the KEV addition, CISA directed Federal Civilian Executive Branch agencies to remediate CVE-2026-45659 by July 4, 2026, under Binding Operational Directive 26-04. Multiple sources describe the deadline as within three days or by Saturday.
CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalog after citing evidence of active exploitation against Microsoft SharePoint Server. The agency also warned that authenticated attackers with Site Member permissions can exploit the deserialization flaw for remote code execution.
The Canadian Centre for Cyber Security issued Alert AL26-015 warning that CVE-2026-45659 in on-premises Microsoft SharePoint Server was being actively exploited. The alert urged organizations to identify internet-exposed SharePoint servers, apply Microsoft's latest updates, upgrade to fixed versions, and noted upcoming July 14, 2026 end-of-life dates for SharePoint Enterprise Server 2016 and SharePoint Server 2019.
CISA added CVE-2026-45659, a Microsoft SharePoint Server deserialization vulnerability, to its Known Exploited Vulnerabilities catalog and stated it had been exploited in the wild. The KEV entry directed organizations to apply vendor mitigations, follow BOD 26-04 and forensics guidance, or discontinue use if mitigations were unavailable.
Microsoft released security updates for CVE-2026-45659 affecting SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. One source says the updates were released on May 21 after the CVE was accidentally omitted from the May 2026 Security Updates, while others describe the patch as an out-of-band release in late May 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcecyber.gc.ca
Open sourcesecurityweek.com
Open sourcethecyberthrone.in
Open sourcebleepingcomputer.com
Open sourcecisa.gov
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CISA** added **CVE-2026-20963**, a **Microsoft SharePoint** deserialization flaw, to its **Known Exploited Vulnerabilities (KEV)** catalog after confirming active exploitation in the wild. The vulnerability allows an **unauthorized remote attacker** to execute arbitrary code over the network by sending crafted serialized data that SharePoint improperly deserializes, creating a **pre-authentication remote code execution** path. Reporting indicates the specific threat actors behind the attacks have not been publicly identified, but the flaw affects a widely deployed enterprise collaboration platform that often stores sensitive internal documents and communications. The KEV entry triggered urgent remediation requirements, including a **March 21, 2026** deadline for **FCEB agencies** under **Binding Operational Directive 22-01**. Additional reporting notes that the same KEV update also included vulnerabilities in **Wing FTP Server** and **Synacor Zimbra Collaboration Suite**, but the SharePoint issue stands out because of its likely value for **initial access brokers** and **ransomware affiliates** seeking enterprise footholds. Organizations using SharePoint should treat internet-exposed systems as high priority for patching and review for signs of compromise given confirmed in-the-wild exploitation.
Jun 29, 2026
More than **1,370 internet-facing Microsoft SharePoint servers** were reported exposed to active exploitation of **`CVE-2026-32201`**, a spoofing vulnerability affecting SharePoint Server 2016, 2019, and Subscription Edition. Microsoft disclosed the flaw in April and CISA added it to the **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders. Although Microsoft scored the bug at **CVSS 6.5**, the risk is elevated because it can be exploited **remotely without authentication** against exposed on-premises deployments, potentially allowing attackers to impersonate users, access or alter sensitive content, steal credentials, and move laterally inside victim environments. The exposure comes amid broader concern over SharePoint security, including Microsoft's disclosure of **`CVE-2026-26106`**, a **remote code execution** vulnerability in SharePoint Server, and earlier reporting that a **China-linked threat actor** was involved in SharePoint attacks, according to Mandiant. The concentration of exposed systems was highest in the **United States**, and the combined reporting points to sustained attacker interest in SharePoint as a route into enterprise networks. Organizations were urged to apply Microsoft's available updates, reduce direct internet exposure of SharePoint servers, and closely monitor authentication and document-access activity for signs of compromise.
Jun 29, 2026
Microsoft issued emergency guidance after attackers exploited zero-day flaws in on-premises **Microsoft SharePoint Server** in campaigns that hit businesses and at least some U.S. government agencies. In one wave, researchers tracked a variant of `CVE-2025-49706` dubbed **"ToolShell,"** warning it could grant full access to SharePoint file systems and connected Microsoft services such as Teams and OneDrive. Microsoft said **SharePoint Online** was not affected, while fixes were released for SharePoint Server 2019 and Subscription Edition and a SharePoint Server 2016 patch was still pending at the time of reporting. U.S. CISA later added another actively exploited SharePoint zero-day, `CVE-2026-32201`, to its **Known Exploited Vulnerabilities** catalog and ordered Federal Civilian Executive Branch agencies to remediate it under **BOD 22-01**. Security firms including Eye Security, CrowdStrike, Google Threat Intelligence Group, and Palo Alto Networks warned that internet-facing SharePoint deployments in government, education, healthcare, and large enterprises face elevated risk, with defenders urged to patch quickly, isolate exposed servers if needed, rotate cryptographic material, and engage incident response support where compromise is suspected.
Jun 29, 2026