SharePoint's latest RCE bug hands attackers the keys with no extra paperwork
CVE-2026-45659 is a deserialization flaw that doesn't ask for much — and that's exactly why Microsoft is shipping fixes across every supported SharePoint Server build.
Think of a server that happily unwraps any package left on its doorstep, no signature required. That's the spirit of CVE-2026-45659, the SharePoint Server bug Microsoft patched this week with a CVSS of 8.8 and an "important" severity tag.
The flaw lives in how SharePoint deserializes untrusted data — feed it a poisoned object and you get remote code execution on the box. Microsoft's own write-up says no special conditions are needed for exploitation, which in plain English means an authenticated attacker with run-of-the-mill SharePoint permissions can pop the server. Fixes are out for SharePoint Server Subscription Edition, 2019, and 2016 via the November update train. Full details and patch links live on the MSRC advisory for CVE-2026-45659.
The "authenticated" caveat is doing less work than it sounds like.
SharePoint deployments are sprawling by design. Contractors, vendors, that one finance intern from 2019 who never got offboarded — any of those accounts is a viable launchpad. And SharePoint deserialization bugs have a nasty track record: ToolShell (the CVE-2025-53770 chain that Storm-2603 and other crews rode through the summer) burned through unpatched on-prem servers and ended up dropping Warlock ransomware on victims, according to incident write-ups from Microsoft and Palo Alto's Unit 42.
None of that history is academic. SharePoint sits on top of your document libraries, your intranet, your half-forgotten HR portal. RCE on the front-end usually means a fast walk to domain creds via the SharePoint farm account, and from there the blast radius is whatever Active Directory will give you.
If you run on-prem SharePoint, the move is boring and urgent: apply the November security update, audit for any web shells dropped under LAYOUTS and _vti_bin, and rotate the machine keys (because if attackers grabbed ValidationKey and DecryptionKey before you patched, the patch alone won't lock them out — that's the lesson ToolShell taught the hard way).
SharePoint Online isn't affected. Small mercy for the tenants who already let Microsoft run their plumbing.
No public exploit code or in-the-wild activity has been flagged yet, but deserialization bugs in Microsoft Office products tend to have short runways between patch and proof-of-concept. Watch the GitHub PoC tracker over the next ten days.
