Loading vulnerability…
Authenticated Remote Code Execution in Microsoft SharePoint Server via Untrusted Deserialization
CVE-2026-45659 is an untrusted deserialization vulnerability in on-premises Microsoft SharePoint Server. An authenticated attacker with low privileges, such as Site Member permissions, can submit a crafted serialized payload over the network. Processing the payload through a vulnerable .NET serializer allows arbitrary code execution in the IIS worker process. Affected products include SharePoint Enterprise Server 2016 before build 16.0.5552.1002, SharePoint Server 2019 before build 16.0.10417.20128, and SharePoint Server Subscription Edition before build 16.0.19725.20280. SharePoint Online and Microsoft 365 are unaffected. The vulnerability has a CVSS 3.1 base score of 8.8 and is included in CISA's Known Exploited Vulnerabilities catalog, with confirmed use in ransomware campaigns.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality, integrity, and availability of the affected SharePoint server through arbitrary code execution. Potential consequences include sensitive-document theft, unauthorized content modification, malware or web shell deployment, and service disruption. Attacks chaining this vulnerability with other SharePoint flaws have included IIS machine-key theft and persistence. Stolen machine keys can support forged requests and continued compromise after patching unless intrusion artifacts are removed and exposed keys are rotated. Ransomware exploitation is confirmed, but a specific ransomware operator has not been officially identified for this vulnerability.
If you can’t patch tonight, do this now.
Avoid direct internet exposure where possible. If external access is necessary, use an authenticated Layer 7 reverse proxy or equivalent application-layer control. Block external access to SharePoint Central Administration and restrict administrative, farm, and database communications to trusted systems. Enable SharePoint AMSI integration and Full request-body scanning where supported. Enforce least privilege and monitor SharePoint, IIS, Windows, and EDR telemetry for suspicious requests, unexpected worker-process child processes, web shells, malicious IIS modules, and machine-key access. If compromise is suspected, isolate affected systems, preserve forensic evidence, and initiate incident response. These measures do not replace patching.
Patch, then assume compromise.
Apply Microsoft's security update for CVE-2026-45659 to every affected SharePoint farm server. Upgrade SharePoint Enterprise Server 2016 to build 16.0.5552.1002 or later, SharePoint Server 2019 to build 16.0.10417.20128 or later, and SharePoint Server Subscription Edition to build 16.0.19725.20280 or later. Prefer current cumulative security updates and verify successful installation across the farm. For compromised deployments, investigate and remove malicious artifacts before rotating IIS/ASP.NET machine keys and exposed credentials; patching alone does not remove established persistence.
2 exploits validated by Mallory's analysis. Hidden: 4 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
346 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.