Ransomware crews are now breaking into SharePoint servers through a May flaw

Key points

• The US Cybersecurity and Infrastructure Security Agency (CISA) confirmed on Tuesday that ransomware gangs are exploiting a Microsoft SharePoint flaw tracked as CVE-2026-45659.
• Microsoft patched the bug in May across SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.
• Shadowserver counts more than 8,500 SharePoint servers exposed to the internet, with over 200 still unpatched.
• CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 1 July and gave federal agencies three days to fix it.
• Eight of the 14 actively exploited SharePoint bugs CISA has tracked since November 2021 have been used in ransomware attacks.

Ransomware gangs have started breaking into Microsoft SharePoint servers through a flaw Microsoft patched in May, CISA confirmed on Tuesday.

SharePoint is the software many organisations use to store internal documents and run team websites. Attackers who get in typically land deep inside the corporate network. Ransomware, malicious software that scrambles files until a payment is made, is the natural next step.

The bug is tracked as CVE-2026-45659. It lets an attacker who already holds a low-level account run their own code on the server, which in practice means full control.

How does the attack work?

The flaw is a deserialization bug: SharePoint trusts data it receives without checking it properly. Feed it the wrong thing and it runs whatever the attacker sent.

Microsoft noted in its May advisory that the attack doesn't require deep knowledge of the target and produces repeatable results. That's exactly the kind of bug ransomware crews favour: reliable, consistent, and equally effective against every unpatched server in a scan.

This is an authorisation problem more than an authentication one. The attacker still needs a low-privilege login, but once inside, the flaw hands them powers they were never meant to have. Multi-factor authentication raises the bar on the initial login; it won't stop the escalation once a valid session exists.

Who is affected?

Any organisation running an on-premises SharePoint server that hasn't installed the May 2026 patches. Three versions are in scope.

Shadowserver, a non-profit that scans the internet for exposed systems, currently sees more than 8,500 SharePoint servers reachable from the public internet, with over 200 still missing the fix.

CISA added the bug to its Known Exploited Vulnerabilities catalogue on 1 July, giving federal civilian agencies three days to patch. That deadline is unusually tight, which signals how seriously the agency read the early exploitation reports. We've been tracking this CVE since we first reported on it 28 May, and the Swiss federal IT office breach we covered on 6 August lines up with exactly this exploitation window.

What should IT teams do now?

Install Microsoft's May patches, confirm they actually applied, and hunt for signs the server was already hit. CISA recommends enabling the Windows Antimalware Scan Interface (AMSI, a Windows feature that lets security tools inspect scripts and data before they run) for SharePoint web apps, and using Microsoft Defender Antivirus to look for known exploitation traces.

This isn't an isolated case. Since November 2021, CISA has flagged 14 actively exploited SharePoint flaws, and eight ended up in ransomware attacks. The pattern's boringly consistent: Microsoft ships a patch, admins delay, criminals scan, and someone's negotiating with a ransom crew a few weeks later.

In June, CISA also confirmed that ransomware gangs were exploiting a Microsoft Defender privilege escalation flaw, CVE-2026-33825, nicknamed BlueHammer. A researcher going by "Nightmare Eclipse" leaked it as a zero-day in early April with working exploit code attached.

Microsoft hasn't updated either advisory to mark the flaws as exploited in the wild. CISA, clearly, disagrees.

Common questions

Does multi-factor authentication protect against this?

Partly. MFA makes the initial login harder to compromise, but CVE-2026-45659 operates after authentication. A valid low-privilege session is all an attacker needs to trigger the escalation.

Should you worry if you use SharePoint Online?

No. The flaw affects on-premises installations only. Microsoft's cloud-hosted SharePoint Online is not in scope.