CVE-2026-45659

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-45659 8.8

Microsoft · SharePoint Server · Added 2026-07-01

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityMicrosoft SharePoint Server Deserialization of Untrusted Data Vulnerability

VendorMicrosoft

ProductSharePoint Server

Date added2026-07-01

Due date2026-07-04

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-502

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.

NVD: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-26 01:42 UTC

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2026-45659
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659
https://github.com/amnsecurity/sharepoint-deserialization-security-assessment
https://github.com/HORKimhab/CVE-2026-45659
https://threat-modeling.com/cve-2026-45659-microsoft-sharepoint-deserialization-rce-cisa-kev/
https://www.sentinelone.com/vulnerability-database/cve-2026-45659/
https://www.helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659/
https://cvefeed.io/vuln/detail/CVE-2026-45659

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

Hunting hypothesis agent

Hunt SharePoint access logs for POST requests with .NET serialized payloads containing LosFormatter or BinaryFormatter markers targeting the SPListItem deserialization handler, and alert on subsequent webshell creation on the server.

Research details

ComponentSharePoint LosFormatter.Deserialize deserialization handler in Microsoft.SharePoint.Library

PreconditionsAuthenticated low-privilege user (Site Member or equivalent) on Microsoft SharePoint Server 2019/2022/Subscription Edition (on-prem); network access to SharePoint web interface; endpoint accepting serialized .NET payloads via SPListItem handling path. agent

Deliverycrafted HTTP POST request containing malicious .NET serialized object submitted to SharePoint web interface by authenticated Site Member

Public PoCyes

PoC URLs https://github.com/amnsecurity/sharepoint-deserialization-security-assessment
https://github.com/HORKimhab/CVE-2026-45659 Third-party repos; verify before use.

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659

Exploit notesCVSS AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Multiple public PoCs on GitHub | Exploit sends crafted HTTP POST with malicious .NET serialized objects to SharePoint endpoints | Deserialization of untrusted data via LosFormatter.Deserialize in Microsoft.SharePoint.Library | Requires authenticated Site Member access | Tested on pre-May-2026 SharePoint builds | Active exploitation by Storm-2603

SummaryMicrosoft SharePoint Server deserialization of untrusted data (CWE-502) allows authenticated low-privilege users to execute code remotely by submitting crafted .NET serialized objects via the SPListItem handling path. The LosFormatter.Deserialize handler in Microsoft.SharePoint.Library processes untrusted input without validation. Multiple public PoCs exist on GitHub. Active exploitation by Storm-2603 confirmed.

Tia coverage

First reported2026-05-27

First exploit report2026-07-02

Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cve-2026-45659-microsoft-sharepoint-server-deserialization-rce-c cve-2026-50522-new-sharepoint-rce-actively-exploited-to-steal-ma cve-2026-63520-microsoft-sharepoint-remote-code-execution-fixed microsoft-sharepoint-exploitation-fourth-kev-entry-tenable-confi microsoft-testing-cloud-rebuild-remote-system-reinstall-from-the warlock-ransomware-breach-sharepoint-in-water-telecom-operator-a

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.