The SharePoint RCE Microsoft Forgot to Tell You About: Inside CVE-2026-45659

The patch you already installed hides a flaw you never heard about

On July 1, 2026, CISA added CVE-2026-45659 — a remote code execution flaw in Microsoft SharePoint Server — to its Known Exploited Vulnerabilities (KEV) catalog, giving U.S. federal agencies until July 4 to remediate. The unusual part isn’t the severity, though a CVSS score of 8.8 is nothing to shrug at. The unusual part is that most defenders had never seen this CVE before it showed up on the KEV list.

Microsoft actually shipped the fix in its May 2026 security updates. It just forgot to tell anyone. The CVE was inadvertently omitted from the May Security Update guide, and the vendor’s original exploitation assessment was “less likely.” CISA’s KEV addition flipped that assessment on its head: the flaw is being exploited in the wild right now, and a large population of administrators believe they are unpatched when they may already be covered — or worse, believe they are covered when they are not. If you run SharePoint on-premises, this is the ambiguity you need to resolve today.

Technical Analysis: deserialization strikes SharePoint again

CVE-2026-45659 is a classic insecure deserialization vulnerability. SharePoint accepts a serialized object inside a request and reconstructs it into a live in-memory object without adequately validating what it is rebuilding. When an attacker controls the serialized payload, they control what the server instantiates — and in .NET, the wrong gadget chain turns object reconstruction into arbitrary code execution.

The vulnerable code path runs LosFormatter.Deserialize on attacker-controlled data that flows through the Update() method of list items when custom field types using ViewState-like serialization are processed. LosFormatter is the same limited-object-serialization mechanism that has historically underpinned ASP.NET ViewState attacks, and it remains dangerous whenever the input isn’t cryptographically validated or type-constrained before deserialization.

What makes this bug practically severe is the low bar to trigger it. The CVSS vector carries Privileges Required: Low (PR:L). An attacker does not need administrative rights — a minimum of Site Member permissions is enough. In a typical enterprise SharePoint deployment, Site Member is an ordinary, widely granted role. That means the attack surface isn’t a handful of admins; it’s every authenticated user who can add or update a list item, plus any account an attacker can phish or spray their way into.

Affected products are the on-premises editions: SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. SharePoint Online (Microsoft 365) is not in scope for this specific advisory, but on-prem farms — common in regulated industries, government, and large enterprises with data-residency requirements — are squarely in the blast radius.

Proof-of-concept material has already surfaced publicly, which historically compresses the window between disclosure and mass scanning to days. CISA has stated it does not yet know who is exploiting the flaw or what the end goal is, which is exactly the posture defenders should treat as most dangerous: active, attributed-to-nobody, and opportunistic.

Impact Assessment

Risk rating: Critical for on-premises SharePoint operators.

A successful exploit yields code execution in the context of the SharePoint web application — typically a service account with broad access to content databases, connected services, and often lateral pathways into the surrounding Active Directory environment. SharePoint servers are rarely isolated; they sit at the intersection of document stores, identity, and business workflows. RCE on that tier is a foothold with unusually high leverage.

The business impact spans data exfiltration (SharePoint is where organizations keep their most sensitive documents), ransomware staging, and long-dwell espionage. Sectors most exposed are those that kept SharePoint on-premises for compliance reasons — government, healthcare, legal, finance, and defense contractors. The irony is sharp: the same organizations that avoided the cloud for control now carry the patching burden that cloud tenants offloaded to Microsoft.

The disclosure gap amplifies everything. Because the CVE was omitted from the May guide, vulnerability scanners, patch-compliance dashboards, and change-management tickets may never have flagged it. Teams that pride themselves on a clean patch posture can be exposed simply because the flaw was invisible to their tooling until July.

CloudShieldSecure Perspective

This incident is a textbook argument for continuous exposure monitoring rather than point-in-time patch verification. CloudShieldSecure’s approach is built around the assumption that vendor advisories will be incomplete, late, or — as here — silently amended after the fact. Detecting a deserialization RCE isn’t only about knowing a KB number is installed; it’s about watching for the behaviors that follow exploitation: anomalous child processes spawned by the SharePoint worker process (w3wp.exe), unexpected outbound connections from the web tier, and serialization payloads hitting list-item update endpoints.

By correlating configuration state (which SharePoint builds are running, which accounts hold Site Member and above) with runtime telemetry, CloudShieldSecure surfaces the exact gap this CVE exploits: the difference between “we think we patched” and “we can prove this server cannot be exploited.” That reconciliation is where most breaches hide, and it’s exactly the visibility we built the platform to provide.

Recommended Actions

Work through this checklist today if you operate SharePoint on-premises:

1. Confirm your May 2026 updates are genuinely applied. Do not trust the change ticket — verify the installed build number against Microsoft’s May 2026 SharePoint update references for your specific edition. If the May updates are in place, Microsoft states no further action is required for this CVE.
2. Identify any farm that skipped or deferred the May cycle. These are your exposed assets. Prioritize internet-facing SharePoint above all.
3. Audit Site Member and above. Reduce standing permissions to least privilege. Every account at Site Member or higher is a potential trigger point.
4. Hunt retroactively. Assume you may have been exposed since May. Review web-tier logs for anomalous w3wp.exe child processes, unexpected script execution, and unusual list-item update activity. Check for new or modified files in SharePoint layout directories.
5. Restrict and monitor deserialization endpoints. Where a WAF sits in front of SharePoint, tune rules to inspect and rate-limit list-item update traffic.
6. Rotate SharePoint service-account credentials if you find any indicator of compromise, and treat lateral movement into AD as the assumed next step.
7. Fix your detection gap, not just this bug. Add a control that reconciles “advisory says patched” against “runtime proves not exploitable,” so the next silently-omitted CVE doesn’t stay invisible.

The lesson of CVE-2026-45659 outlasts the CVE itself: your patch posture is only as trustworthy as the disclosures feeding it, and this month’s disclosure was incomplete by the vendor’s own admission. Defenders who assume advisories are ground truth will keep getting surprised. Defenders who verify exploitability directly will not.

Sources & References

• The Hacker News — SharePoint RCE CVE-2026-45659 Added to CISA KEV
• The Hacker News — Microsoft Patches SharePoint RCE Flaw CVE-2026-45659
• Help Net Security — High-severity SharePoint RCE bug patched
• NVD — CVE-2026-45659 Detail
• CISA Known Exploited Vulnerabilities Catalog

Published by CloudShieldSecure — cloud security posture and exposure monitoring by CloudKonsult Limited. cloudshieldsecure.cloudkonsult.cloud