CVE-2026-45659 — Microsoft SharePoint Server Deserialization RCE (CVSS 8.8) — Site Member-Level Access Only Required

CVE-2026-45659 is a remote code execution flaw in Microsoft SharePoint Server caused by deserialization of untrusted data (CWE-502), fixed in Microsoft's May 2026 Patch Tuesday batch of more than 130 vulnerabilities. It is rated CVSS 8.8 with a network attack vector, low complexity, and no user interaction, and the only prerequisite is an authenticated account with Site Member permissions, a tier most organizations hand out freely for routine collaboration. Exploitation runs arbitrary .NET deserialization gadget chains in the context of the SharePoint application service account. CISA has since added CVE-2026-45659 to the Known Exploited Vulnerabilities catalog, which turns a routine Patch Tuesday entry into a confirmed, actively used bug.

The severity argument is the privilege floor, not the score. Site membership is the cheapest credential in a SharePoint estate: contractors, partners, service desks, and self-service provisioning all mint these accounts, so the exposed population on an unpatched farm is effectively every credential holder, not just administrators. A successful run executes code as the application service account, which reaches farm content and configuration, meaning the practical outcome is read and write access to everything the collaboration tier stores plus a persistent foothold inside the network. The family history sharpens the risk: CVE-2026-20963, the earlier SharePoint deserialization bug, was re-scored to CVSS 9.8 and KEV-listed in March 2026 after unauthenticated exploitation was confirmed. That precedent shows how the authenticated-only label on this bug class erodes once attackers find a chaining path or an anonymous-reachable endpoint, and it is why this story outranks the other Patch Tuesday entries.

Patch by build: KB5002863 for SharePoint Server Subscription Edition, KB5002870 for SharePoint Server 2019, and KB5002868 for SharePoint Server 2016, prioritizing internet-facing farms first. Where patching lags, tighten who can hold site member rights and review access for external accounts. The hunt follows from the mechanism: because the payload executes .NET gadget chains in-process under the SharePoint application service account, look for a child process such as cmd.exe or PowerShell spawned by that account's web worker, .NET deserialization exceptions in application logs, and unexpected assemblies written to disk. IIS logs on SharePoint front ends should be reviewed for write requests against _layouts and _api paths from accounts whose only role is site membership.

Two developments would change the assessment. A revision of the permission requirement toward unauthenticated access, the exact path CVE-2026-20963 followed to a 9.8 KEV entry, would demand emergency patching and immediate exposure review. Public gadget chain details or PoC code naming the affected endpoints would give both sides precision: it would let defenders hunt on exact request signatures, and it would hand attackers the missing step between a member account and the service account's execution context.