CISA confirmed today that ransomware gangs have begun abusing a high-severity Microsoft SharePoint remote code execution vulnerability, which has been flagged as actively exploited since early July.
Tracked as CVE-2026-45659, this security flaw stems from a deserialization of untrusted data weakness and allows attackers with low privileges to execute arbitrary code on unpatched SharePoint servers.
It can also be exploited in low-complexity attacks because (as Microsoft explained in May when it released security updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition) “an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.”
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities Catalog (KEV) on July 1, ordering Federal Civilian Executive Branch (FCEB) agencies to secure their servers within three days.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the U.S. cybersecurity agency warned at the time.
In a subsequent advisory, the cybersecurity agency also urged security teams to monitor affected servers for signs of exploitation, apply Microsoft’s latest patches, verify successful installation, and shorten patching cycles.
It also recommended enabling Windows Antimalware Scan Interface (AMSI integration for SharePoint web applications and using Microsoft Defender Antivirus (MDAV) detections to detect and remediate compromise.
Internet security watchdog group Shadowserver currently tracks over 8,500 Microsoft SharePoint servers exposed online, with over 200 of them unpatched against the CVE-2026-45659 vulnerability.
While Microsoft has yet to update the CVE-2026-45659 advisory to tag it as exploited, CISA has now also flagged it as abused by ransomware gangs in a Tuesday update to the KEV Catalog.
Since November 2021, the cybersecurity agency has flagged 14 actively exploited Microsoft SharePoint vulnerabilities, with eight of them also exploited in ransomware attacks.
In June, CISA also confirmed that ransomware gangs now exploit a high-severity Microsoft Defender privilege escalation vulnerability (dubbed BlueHammer), which was also targeted as a zero-day to access the Security Account Manager (SAM) database, which contains password hashes for local accounts.
The security flaw (tracked CVE-2026-33825) was leaked by a security researcher known as “Nightmare Eclipse” in early April, together with proof-of-concept exploit code.
However, as with CVE-2026-45659, Microsoft has yet to confirm that the CVE-2026-33825 security flaw is being exploited in the wild.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
CISA: Microsoft SharePoint RCE flaw now actively exploited
CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws
CISA orders urgent action on actively exploited Langflow RCE flaw
CISA warns admins to patch actively exploited SharePoint flaws
Critical Langflow RCE flaw exploited to hack AI app servers
Hackers breach TrueConf to trojanize client installers with backdoors
LexisNexis shuts down services after suspicious activity on servers
Valve notifies Steam hardware customers of a data breach
See how Skyhigh Security’s patent-pending approach secures every browser session without costly and clunky enterprise browser replacements.
See how real inboxes, fake stores and AI scams shaped H1 2026 cyber threats
AI is a data-breach time bomb: Read the new report
Overdue a password health-check? Audit your Active Directory for free
Webinar: Shadow AI in 2026 (and how attackers are taking advantage)
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
