SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
CISA adds actively exploited SharePoint RCE CVE-2026-45659 (CVSS 8.8) to KEV; an August 11 update confirms ransomware groups are exploiting the flaw.
CVE-2026-45659 is a deserialization of untrusted data RCE in Microsoft SharePoint Server affecting Subscription Edition, 2019, and 2016, patched by Microsoft in May 2026. An authenticated attacker with at least Site Member permissions can execute code remotely over the network. CISA added the flaw to its KEV catalog on July 2 with a July 4 deadline for federal agencies, and on August 11 confirmed ransomware groups are exploiting it. Microsoft separately described Storm-2603 (Warlock ransomware) and an unrelated actor co-existing in one network, with initial access likely via the Gladinet Triofox flaw CVE-2025-11371 (CVSS 9.1).
- Attackers used Velociraptor, Cloudflare tunneling, Zoho Assist, and SSH via Visual Studio Code to blend with admin activity.
- A vulnerable driver (NSecKrnl.sys) was used to tamper with endpoint security protections and reduce visibility.
- A second actor used DLL side-loading and custom backdoors, complicating attribution and response.
- Attackers escalated privileges by creating new local and domain administrator accounts.
- Both attackers moved laterally into a second organization, masking the intrusion's full scope.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1136.002 Domain AccountT1574.002 DLL Side-LoadingT1562.001 Impair Defenses: Disable or Modify Tools
- Threat actors
- Storm-2603
- Malware
- Warlock ransomware
- Organizations
- CISAMicrosoft Incident Response
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-11371 | Unauthenticated Local File Inclusion in Gladinet CentreStack and Triofox | 7.5 | 92% | KEVPoC | KEV |
| CVE-2026-45659 | Authenticated Deserialization RCE in Microsoft SharePoint Server (Actively Exploited) | 8.8 | 80% | KEVRansomware | KEV |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Jul 02, 2026 Vulnerability / Threat Intelligence The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.