CISA’s addition of CVE-2026-45659 to the Known Exploited Vulnerabilities catalog on July 1 highlights a recurring problem in enterprise vulnerability management: vendor-provided exploitability ratings can understate real-world risk, and defenders who rely on them to prioritise patching get burned.
Microsoft patched this deserialization vulnerability in its May 2026 Patch Tuesday release and assessed the likelihood of exploitation as “Less Likely.” CISA’s KEV listing — which requires confirmed evidence of active exploitation in the wild — means someone was already using it against live targets. Federal agencies received a July 4 remediation deadline.
What the Vulnerability Does
CVE-2026-45659 is a deserialization of untrusted data flaw in SharePoint Server (Subscription Edition, 2019, and 2016). The attack path is straightforward: an authenticated user with Site Member-level permissions — a normal, unprivileged contributor role in most SharePoint deployments — can send a crafted request to achieve remote code execution on the server.
The CVSS base score of 8.8 reflects both the severity of code execution and the low privilege requirement. No admin access is needed. In typical enterprise SharePoint deployments where broad contributor access is granted to employees, contractors, and external collaborators, the attacker population eligible to exploit this is large.
The exploitation mechanism requires network access to the SharePoint server — this is not a remote-unauthenticated path — but in any environment where SharePoint is internet-facing, which includes many organisations using SharePoint Online hybrid configurations or on-premises deployments with external access portals, the constraint is minimal.
Why the ‘Less Likely’ Assessment Matters
Microsoft’s exploitability guidance, when it proves wrong, creates a specific category of patching failure. Security teams under patch backlog pressure routinely use exploitability ratings to sequence remediation. Vulnerabilities rated “Exploitation Less Likely” get deprioritised behind “Exploitation More Likely” items. When active exploitation emerges on a lower-rated flaw, the exposure window has often been long.
This pattern recurs with enough frequency that it warrants a standing posture: CVSS base score and vendor exploitability assessments should inform but not determine patching priority for widely deployed enterprise platforms. For Microsoft products on internet-facing infrastructure, vendor-rated “less likely” still means “patch promptly.”
Sector Exposure
SharePoint is heavily deployed across every sector Adversary Wire monitors.
Finance: SharePoint underpins document management, workflow, and internal knowledge bases at most large financial institutions. RCE on a SharePoint server provides code execution in an environment likely to have connections to internal networks, file shares, and downstream systems.
Healthcare: NHS trusts and private health networks in the UK use SharePoint extensively for clinical and administrative document management. A compromised SharePoint server in a healthcare environment provides a foothold adjacent to patient data systems.
Critical infrastructure and government: SharePoint is a standard platform in central government, local authorities, and utility sector operations. On-premises SharePoint deployments — common in security-sensitive environments that avoid cloud platforms — may have received the May patch on slower schedules.
Communications: Large telecoms and media organisations use SharePoint for project and document management at scale. Compromise of a SharePoint server in a communications network provides an initial foothold with potential for lateral movement toward higher-value systems.
Recommended Actions
Patch immediately. CVE-2026-45659 is addressed in Microsoft’s May 2026 cumulative update for SharePoint Server. If your organisation runs SharePoint Server on-premises (any supported version), this patch should be applied without further delay.
Audit current patch status. In enterprises running multiple SharePoint farm servers, confirm that all nodes in the farm received the cumulative update — partial patching in multi-server farms is a common exposure point.
Review authenticated access controls. Audit which accounts hold Site Member or higher permissions in SharePoint sites that are accessible from outside the corporate network. In many organisations, external collaboration has expanded SharePoint’s authenticated attack surface beyond what was intended.
Check for signs of exploitation. Review SharePoint server application and IIS logs for anomalous deserialization-related errors or unexpected process spawns from the SharePoint worker process (w3wp.exe). Lateral movement from a compromised SharePoint server may appear as unusual outbound connections or new scheduled tasks created by the SharePoint service account.
Restrict network exposure where possible. If SharePoint sites serving external users can be limited to specific IP ranges or placed behind additional authentication controls (conditional access, VPN requirements), the effective attack surface for authenticated external exploitation is reduced.
The gap between Microsoft’s initial “Less Likely” assessment and confirmed active exploitation underlines why KEV listings remain one of the most actionable signals available. Any CVE that reaches the KEV catalog has cleared the bar of confirmed exploitation; it belongs at the front of the remediation queue regardless of what the vendor’s initial advisory said.