Ransomware crews are now breaking into SharePoint servers through a May flaw

Key points

• The US Cybersecurity and Infrastructure Security Agency (CISA) confirmed on Tuesday that ransomware gangs are exploiting a Microsoft SharePoint flaw tracked as CVE-2026-45659.
• Microsoft patched the bug in May across SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.
• Watchdog group Shadowserver counts more than 8,500 SharePoint servers exposed to the internet, with over 200 still unpatched.
• CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 1 July and gave federal agencies three days to fix it.
• Since November 2021, eight of the 14 actively exploited SharePoint bugs tracked by CISA have been used in ransomware attacks.

Ransomware gangs have started breaking into Microsoft SharePoint servers through a flaw that Microsoft patched back in May, the US Cybersecurity and Infrastructure Security Agency confirmed on Tuesday.

SharePoint is the software many companies use to store internal documents and run team websites. If attackers get in, they usually get a foothold deep inside the corporate network. Ransomware, malicious software that scrambles a company's files until a payment is made, is the natural next step.

The bug is tracked as CVE-2026-45659. It lets an attacker who already has a low-level account run their own code on the server. In practice, that means taking full control.

How does the attack work?

The flaw is a deserialization bug, which is a fancy way of saying SharePoint trusts data it receives without checking it properly. Feed it the wrong thing and it runs whatever the attacker sent.

Microsoft said in its May advisory that the attack is easy to repeat and does not need deep knowledge of the target system. That is exactly the kind of bug ransomware crews love: reliable, quiet, and it works the same way on every unpatched server.

This is an authorisation problem more than an authentication one. The attacker still needs a low-privilege login (auth), but once inside, the flaw hands them powers they were never meant to have (authz). Multi-factor authentication would raise the bar on the initial login, but it would not stop the escalation once a valid session exists.

Who is affected?

Any organisation running an on-premises SharePoint server that has not installed the May 2026 patches. Three versions are in scope.

Shadowserver, a non-profit that scans the internet for exposed systems, currently sees more than 8,500 SharePoint servers reachable from the public internet. Over 200 of those are still missing the fix for CVE-2026-45659.

CISA added the bug to its Known Exploited Vulnerabilities catalogue on 1 July, giving federal civilian agencies three days to patch. That timeline is unusually tight, which tells you how seriously the agency took the early exploitation reports.

What should IT teams do now?

Install Microsoft's May patches, confirm they actually applied, and then hunt for signs the server was already hit. CISA recommends turning on the Windows Antimalware Scan Interface (AMSI) for SharePoint web apps and using Microsoft Defender Antivirus to look for known exploitation traces.

As first reported by BleepingComputer, this is not an isolated case. Since November 2021, CISA has flagged 14 actively exploited SharePoint flaws. Eight of them ended up in ransomware attacks. The pattern is boringly consistent: Microsoft ships a patch, admins delay, criminals scan the internet, and a few weeks later someone is negotiating with a ransom crew.

In June, CISA added a Microsoft Defender privilege escalation bug, CVE-2026-33825, nicknamed BlueHammer, to the same list. That one was leaked as a zero-day, meaning a flaw the vendor did not know about, by a researcher going by "Nightmare Eclipse" in early April, complete with working exploit code.

Microsoft has still not updated either advisory to mark the flaws as exploited in the wild. CISA, clearly, disagrees.