SharePoint CVE-2026-45659 Ransomware Attacks Confirmed

CISA confirmed today that ransomware operators have adopted CVE-2026-45659, a high-severity deserialization remote code execution vulnerability in on-premises Microsoft SharePoint Server. The CVE has been on the CISA Known Exploited Vulnerabilities catalog since July 2 — now CISA is specifically calling out ransomware gang involvement.

That’s the escalation signal. General exploitation in the wild is one thing. Ransomware operators systematically deploying against a specific CVE is how you get a mass-casualty incident across a sector.

What CVE-2026-45659 Does

Deserialization of untrusted data in on-premises SharePoint Server leads to remote code execution. CVSS 8.8, rated high severity. Microsoft patched it in the May 2026 cumulative update. CISA added it to the KEV catalog on July 2 after confirming active exploitation in the wild.

SharePoint Server is the target because of what it holds: internal documents, project plans, HR records, credentials pasted into wiki pages because someone thought it was safe. Code execution as the SharePoint service account is usually enough to pivot laterally — you don’t need domain admin on day one.

Full CVE details: CVE-2026-45659.

What’s New Today

The ransomware connection. In July, exploitation was confirmed but the threat actor profile was unclear. CISA’s update today specifically identifies ransomware gangs as active operators — which means this is operational tooling for at least one ransomware operation, not opportunistic scanning by low-sophistication actors.

Also today: Rapid7 lifted its 30-day disclosure embargo and published full technical analysis of CVE-2026-55040, a separate SharePoint JWT authentication bypass (CVSS 9.1), along with disclosing the RCE component that completes that attack chain. Two separate SharePoint attack surfaces with newly public details, on the same day a ransomware confirmation drops for a third SharePoint CVE. On-premises SharePoint is getting a lot of attention from threat actors right now.

What to Do

1. Verify you’ve applied the May 2026 cumulative update. Most shops running Patch Tuesday cycles are current — but on-premises SharePoint farms with custom or delayed patch windows are exactly the kind of infrastructure that slips. Confirm it, don’t assume. The MSRC advisory has affected build ranges.

2. Apply July Patch Tuesday too. CVE-2026-55040 — the separate CVSS 9.1 auth bypass — was fixed in the July cumulative update. Full technical details and a PoC are now public. If you patched May but not July, you’re exposed on the second chain. The July Patch Tuesday writeup covers the full scope.

3. Audit SharePoint service account activity. For the CVE-2026-45659 window — May through now — review authentication logs for unexpected service account sessions, unusual deserialization errors, and lateral movement originating from SharePoint. Ransomware operators who gained access months ago may be dormant before deploying. If you see anomalies, treat it as a confirmed compromise and escalate to IR.

4. Restrict access if patching is delayed. Unpatched on-premises SharePoint reachable from any untrusted network segment is the exposure. If you can’t patch immediately, isolate the SharePoint farm to trusted segments while you schedule the maintenance window.

This moves to the top of the remediation queue. Two separate SharePoint RCE chains with public PoC details, one confirmed in active ransomware campaigns — patch SLA exceptions don’t apply here.

Track all CISA-confirmed actively exploited CVEs on the KEV tracker.