SharePoint's latest RCE bug hands attackers the keys with no extra paperwork
CVE-2026-45659 is a deserialization flaw that doesn't ask for much, and that's exactly why Microsoft is shipping fixes across every supported SharePoint Server build.
Key points
- CVE-2026-45659 is a deserialization flaw in SharePoint Server carrying a CVSS score of 8.8 and an "important" severity rating.
- Any authenticated user with standard SharePoint permissions can trigger remote code execution, no elevated privileges required.
- Patches are out for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016.
- SharePoint Online is not affected.
- No public exploit code has been confirmed yet, but deserialization bugs in Microsoft products tend to have short windows between patch and proof-of-concept.
What exactly is this flaw?
The bug lives in how SharePoint deserializes untrusted data. Feed it a crafted object and you get remote code execution on the host. Microsoft's advisory confirms no specialized conditions are required for exploitation, which means an authenticated attacker holding ordinary SharePoint permissions can take the server. Fixes landed this week for Subscription Edition, 2019, and 2016 via the November security update. Full details and patch links are at the MSRC advisory for CVE-2026-45659.
We first picked up SharePoint's vulnerability story in our April Patch Tuesday coverage and have run 19 SharePoint stories since, 17 in the last 90 days alone.
Should you worry about the "authenticated" requirement?
Yes, more than it sounds. SharePoint deployments accumulate accounts over years: contractors, vendors, the finance intern from 2019 who never got offboarded. Any of those is a viable launchpad. RCE on the front-end typically means a fast walk to domain credentials via the SharePoint farm account, and from there the blast radius is whatever Active Directory will hand over.
Deserialization bugs in SharePoint have a track record worth taking seriously. Microsoft and incident responders have documented prior SharePoint deserialization chains being used to drop ransomware on unpatched on-prem servers. None of that history is academic when your document libraries and intranet sit on the same box.
What should on-prem admins do right now?
Apply the November security update. After that, audit for web shells dropped under LAYOUTS and _vti_bin, and rotate the machine keys. If attackers grabbed ValidationKey and DecryptionKey before you patched, the patch alone won't lock them out. That's the lesson prior SharePoint exploits taught, and it still applies here.
SharePoint Online isn't affected, small mercy for tenants who let Microsoft run their infrastructure.
How long before a public exploit appears?
No exploit code or in-the-wild activity has been confirmed as of this writing. That said, deserialization bugs in Microsoft products tend to move from patch to proof-of-concept quickly. Watch public PoC trackers over the next week or two.
