Microsoft Patches a Dangerous SharePoint Flaw

Any user with basic site access can exploit this vulnerability remotely. Here is what it means, how attackers have abused similar flaws in the past, and what you need to do right now.

Microsoft has released a security patch for a newly discovered flaw in on-premises SharePoint Server, tracked as CVE-2026-45659. The vulnerability carries a CVSS score of 8.8 out of 10 and allows an attacker to remotely run malicious code on a SharePoint server without needing administrator access. Any user who holds basic Site Member permissions, the kind routinely given to contractors, temporary staff, and external collaborators, could potentially exploit this flaw over a network connection.

While Microsoft currently considers this particular vulnerability unlikely to be actively exploited in the near term, the company’s own history with SharePoint shows that patches are reverse-engineered quickly and working exploits often appear within days of public disclosure. Organizations running on-premises SharePoint should treat this update as urgent.

What the Vulnerability Is and How It Works

The root cause is a process called insecure deserialization. To understand what that means in plain terms: SharePoint regularly converts data into a compact format to pass it between different parts of the application, then unpacks it again on the other end. This is called serialization and deserialization. When done safely, the application checks that the data has not been tampered with before unpacking it. CVE-2026-45659 exists because SharePoint does not perform this check carefully enough, allowing an attacker to slip in a maliciously crafted data package that the server unpacks and executes as code.

Deserialization flaws are particularly dangerous because they can give an attacker the same level of control as the software process itself. In SharePoint’s case, that means the attacker could run commands on the underlying server, plant hidden backdoors, steal files, or use the compromised server as a stepping stone into the rest of the organization’s network.

Why SharePoint Is Such a Valuable Target for Attackers

SharePoint sits at the center of many organizations’ digital infrastructure. It stores sensitive documents, HR records, financial data, legal files, engineering specs, and internal communications. Many organizations also expose it directly to the internet to support remote workers and external collaborators, which makes it directly reachable by anyone with an internet connection.

Beyond the data it holds, SharePoint is often tightly connected to other critical systems: SQL databases, Active Directory, Microsoft Exchange, cloud authentication services, and Microsoft 365. A successful attack on SharePoint can quickly become a launchpad into those connected systems, giving attackers a much wider foothold than the initial breach might suggest.

How Attackers Have Exploited Similar SharePoint Flaws in the Past

History provides useful context for why SharePoint patches deserve fast attention. The following real-world cases all involved remote code execution vulnerabilities in SharePoint and show the pattern of what happens when organizations delay applying fixes.

Which Versions Are Affected and What Has Been Patched

Microsoft has released fixes for three supported versions of SharePoint Server. Organizations should verify they have reached or exceeded the following build numbers.

Organizations running older or unsupported versions of SharePoint should treat this as a priority migration issue. Unsupported versions do not receive patches and remain permanently exposed to known and future vulnerabilities.

What Your Security Team Should Do Now

Applying the patch is the most important immediate step, but it should not be the only one. Based on the patterns seen in previous SharePoint exploitation campaigns, security teams should also take the following actions.

SharePoint has had several critical, actively exploited vulnerabilities over the years. Though Microsoft deems CVE-2026-45659 less likely to be exploited, organizations with on-premises SharePoint servers should still treat this as a material update and implement it sooner rather than later. — Help Net Security, May 26, 2026

Collaboration Platforms Are Infrastructure, Not Just File Shares

The repeated targeting of SharePoint reflects a broader strategic shift in how sophisticated attackers choose their entry points. Enterprise collaboration platforms used to be treated primarily as document-sharing tools. They are now recognized as critical infrastructure, tightly integrated with identity systems, cloud environments, and backend databases.

A successful attack on SharePoint does not end at SharePoint. As the 2025 ToolShell campaigns demonstrated, attackers use the initial access to extract cryptographic keys, forge authentication tokens, move into Active Directory, and in the most severe cases, deploy ransomware across the organization’s broader infrastructure. Nation-state groups approach these platforms as intelligence collection opportunities. Ransomware operators approach them as leverage.

This is why patching alone, while necessary, is not sufficient. Organizations that rely on SharePoint as a core business tool need to treat it with the same level of security rigor applied to domain controllers and email servers, with active monitoring, strict access controls, and a tested incident response plan for the scenario where it is compromised.

References

Official advisories

Historical SharePoint exploitation research

This article is provided for informational purposes only. Organizations should refer to official Microsoft advisories for authoritative patching guidance and consult qualified security professionals for incident response support.