The US Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday said threat actors have been exploiting a high-severity vulnerability in Microsoft SharePoint Server.
Described as a deserialization of untrusted data bug, the exploited security defect allows authenticated attackers to execute arbitrary code on vulnerable SharePoint servers.
The flaw is tracked as CVE-2026-45659 (CVSS score of 8.8) and was patched in late May, via an out-of-band security update.
According to Microsoft, the vulnerability can be triggered by an authenticated attacker who has a minimum of Site Member permissions, without other elevated privileges.
The tech giant also warned that the security defect is easy to exploit, “because an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.”
SharePoint Server Subscription Edition, SharePoint Server 2019, SharePoint Server 2016, and SharePoint Enterprise Server 2016 are affected, Microsoft said.
On Wednesday, CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, as mandated by BOD 26-04.
CISA has not shared details on the observed attacks, and there have been no reports of in-the-wild exploitation of the vulnerability before the agency’s warning.
All organizations are advised to apply Microsoft’s patches as soon as possible. SharePoint is the backbone of document sharing, intranet, and collaboration within enterprises, and attackers frequently target security defects in it.
In April, Microsoft patched a SharePoint bug exploited as a zero-day. In March, CISA warned of another flaw in Microsoft’s product being targeted in the wild.
Related: Adobe Patches Critical ColdFusion, Campaign Classic Vulnerabilities
Related: Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack
Related: Apple Patches Dozens of Vulnerabilities Across iOS, macOS, and Safari
