CVE-2026-45659: Microsoft Office SharePoint deserialization of untrusted data

CVE-2026-45659 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2026-05-22

Microsoft SharePoint Server, a widely used platform for document management and team collaboration, is vulnerable to a security flaw that allows remote code execution. An attacker with basic user permissions can exploit this vulnerability to run malicious commands on the server. This could lead to a total compromise of the server, including the theft of sensitive corporate data, service disruption, or further lateral movement within the organization's network.

Technologies: Microsoft SharePoint, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition. Vendors: Microsoft.

Quick answers

Is CVE-2026-45659 exploited in the wild?
Yes. CVE-2026-45659 is known to be exploited in the wild, first recorded on 1 July 2026. Treat it as urgent.
How severe is CVE-2026-45659?
Critical severity, with a CVSS score of 8.8, published 22 May 2026.
Which products and versions are affected?
Microsoft SharePoint Enterprise Server 2016 < 16.0.5552.1002; Microsoft SharePoint Server 2019 < 16.0.10417.20128; Microsoft SharePoint Server Subscription Edition < 16.0.19725.20280.
Is there a fix for CVE-2026-45659?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45659 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45659?
Check whether you run Microsoft SharePoint, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A deserialization vulnerability (CWE-502) exists in Microsoft SharePoint Server due to the improper handling of untrusted data. An authenticated attacker with Site Owner permissions or higher (though CVSS indicates Low Privileges) can exploit this by sending a specially crafted network request to a vulnerable SharePoint instance. Successful exploitation allows the attacker to execute arbitrary code in the context of the SharePoint service account. The vulnerability affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Microsoft has released security updates to address this issue.

Affected products

  • Microsoft SharePoint Enterprise Server 2016 < 16.0.5552.1002
  • Microsoft SharePoint Server 2019 < 16.0.10417.20128
  • Microsoft SharePoint Server Subscription Edition < 16.0.19725.20280

Timeline

  • 2026-05-22: disclosed: Initial NVD publication date
  • 2026-06-17: other: Last modified date in NVD record
  • 2026-07-01: advisory: Advisory publication date provided in report

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.