Loading vulnerability…
CVE-2026-45659 is a high-severity remote code execution vulnerability in on-premises Microsoft SharePoint Server caused by deserialization of untrusted data. The flaw affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. An authenticated attacker with low privileges, including Site Member-level access, can send crafted serialized data to a vulnerable SharePoint server and trigger arbitrary code execution in the context of the SharePoint service. The issue is remotely exploitable over the network, requires no user interaction, and has been confirmed as actively exploited. Public reporting identifies the root cause as unsafe deserialization, but specific vulnerable components, endpoints, and gadget chains have not been publicly confirmed.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
This repository is a small standalone Python exploit project consisting of one main script (`CVE-2026-45659.py`), a README, and a minimal `.gitignore`. It is not part of a known exploitation framework. The script is presented as an authenticated RCE exploit for a claimed SharePoint deserialization issue, CVE-2026-45659, affecting SharePoint Server 2019, 2022, and Subscription Edition before May 2026. The exploit’s structure is straightforward: it defines a banner, a payload generator, a `SharePointClient` class for HTTP interaction, and a `main()` CLI entry point. The payload generator creates a base64-encoded JSON structure that simulates a malicious .NET deserialization chain using `System.Diagnostics.Process` / `ProcessStartInfo` to run an operator-supplied command. This is notable because the code comments explicitly state the payload is a simplified simulation rather than a full LosFormatter/ObjectStateFormatter gadget chain, suggesting the repository is more of an operational proof-of-concept than a fully weaponized exploit. The client logic uses Python’s standard `urllib` stack with optional SSL verification disabling, Basic Authorization headers, JSON/ODATA-style headers, and support for request digest handling (`X-RequestDigest`) typical of SharePoint state-changing operations. Based on the visible code and README, the exploit authenticates to a SharePoint site, obtains any required anti-CSRF/request digest token, and then attempts to exploit list item update functionality in a specified `SiteName/ListName` path to deliver the serialized payload. The CLI requires target URL, username, password, and site/list path, and optionally accepts a command, proxy, timeout, SSL verification, and a `--shell` mode. Capabilities: authenticated remote command execution against a SharePoint server via crafted serialized data delivered through list item update operations. The default command is `whoami /all`, but the operator can supply arbitrary commands. The payload is hardcoded in structure but customizable in command content, which supports an OPERATIONAL maturity assessment rather than pure POC or framework-grade weaponization. Fingerprintable observables are limited. The repository contains example target and proxy URLs in the README (`https://sharepoint.target.com`, `http://127.0.0.1:8080`), a reference URL to NVD, and author contact/branding URLs. Within the exploit code, the most relevant execution artifacts are `cmd.exe` and `/bin/bash`, which are the process launch targets embedded in the payload. The exact SharePoint REST/API paths are not fully visible in the provided truncated content, but the code clearly constructs requests by concatenating a user-supplied base target with internal request paths and uses SharePoint-specific headers and digest tokens. Overall, this repository appears to be a real exploit script rather than a detection tool or fake destructive sample. However, because the visible payload generation is explicitly described as a simplified simulation of a true .NET deserialization chain, the code should be treated as a plausible exploit PoC/operational script whose success may depend on omitted functions and target-specific SharePoint behavior.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
263 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Microsoft SharePoint Server vulnerability listed by CISA among multiple actively exploited flaws affecting on-premises SharePoint instances.
A Microsoft SharePoint vulnerability mentioned only in related content.
A Microsoft SharePoint Server vulnerability that CISA says is actively exploited in the wild as part of activity involving IIS machine key theft, deserialization for persistence, and malware deployment.
A SharePoint code execution vulnerability that has been exploited in the wild and was patched via an out-of-band update.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.