Microsoft SharePoint Flaw Enables Remote Code Execution Attacks

Microsoft has disclosed a critical remote code execution flaw in SharePoint Server, tracked as CVE-2026-45659, that poses a serious risk to on‑premises collaboration environments.

First published on May 21, 2026 and updated with additional technical details on May 26, the vulnerability stems from deserialization of untrusted data (CWE‑502) and carries a CVSS v3.1 base score of 8.8.

Microsoft SharePoint Vulnerability

The weakness involves unsafe deserialization inside the SharePoint server process. When an attacker supplies crafted serialized input, the server can deserialize it into objects that execute attacker-controlled code within the SharePoint process context.

Deserialization bugs are particularly dangerous because they allow attackers to turn apparently benign data into executable payloads inside trusted services.

CVE-2026-45659 is exploitable over the network and categorized as low complexity, increasing the ease of weaponization. The exploit requires authenticated access to the SharePoint service but does not require any user interaction beyond having valid credentials.

That combination network accessibility, low complexity, and no interactive step makes the flaw attractive for attackers who possess stolen credentials or have insider access.

Successful exploitation results in arbitrary code execution in the SharePoint process:

• Execute arbitrary commands as the SharePoint service account.
• Move laterally across the network to other servers and services.
• Escalate privileges if additional misconfigurations exist.
• Access or exfiltrate sensitive enterprise data managed within SharePoint.
• Disrupt availability of collaboration services and business workflows.

The vector string and Microsoft’s guidance indicate the flaw is network‑accessible and requires only low privileges, which elevates its severity in enterprise deployments where SharePoint is widely reachable by internal users.

The absence of required user interaction further increases exploitation likelihood in environments with compromised credentials or weak access controls.

Microsoft has released security updates that remediate CVE-2026-45659 and strongly recommends immediate patching for affected SharePoint Server instances. Because the vulnerability involves deserialization logic inside the application process, configuration-only mitigations are unlikely to fully remove the risk

Mitigation

• Apply Microsoft’s SharePoint security updates as the top priority.
• Restrict access to SharePoint management endpoints and administrative interfaces to trusted networks or jump hosts.
• Enforce robust authentication: tighten password policies, require multifactor authentication for administrative accounts, and rotate credentials that may be shared.
• Monitor logs and telemetry for anomalous deserialization-related activity, suspicious authentication events, and unusual service‑side commands.
• Deploy and tune EDR solutions to detect process injection, abnormal child processes spawned from SharePoint, and lateral movement indicators.
• Conduct targeted security reviews and deserialization-safe coding checks if custom SharePoint extensions or third‑party add-ons are present.