The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity Microsoft SharePoint Server vulnerability to its Known Exploited Vulnerabilities (KEV) catalog after confirming that the flaw is being actively exploited in the wild, prompting renewed warnings for organizations running on-premises SharePoint environments.
The vulnerability, tracked as CVE-2026-45659, carries a CVSS severity score of 8.8 and affects multiple supported versions of Microsoft SharePoint Server. The flaw was addressed by Microsoft as part of its May 2026 Patch Tuesday security updates, but CISA’s latest action indicates that attackers have now begun exploiting unpatched systems.
The development underscores the growing focus of cybercriminals on enterprise collaboration platforms, particularly internet-facing SharePoint deployments that often serve as gateways to critical business data and internal networks.
CISA Confirms Active Exploitation
CISA announced that CVE-2026-45659 has been added to its KEV catalog following evidence that the vulnerability is being actively exploited. Inclusion in the catalog signifies that federal authorities have determined the flaw poses a significant and immediate risk to organizations.
Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies are required to remediate vulnerabilities listed in the KEV catalog within specified deadlines. For this SharePoint vulnerability, agencies have been instructed to deploy Microsoft’s security updates by July 4, 2026.
Although the directive applies specifically to federal agencies, CISA consistently recommends that private-sector organizations treat KEV-listed vulnerabilities as high-priority patching events because they are already being leveraged by threat actors.
Vulnerability Enables Remote Code Execution
Microsoft identified the issue as a deserialization of untrusted data vulnerability that can lead to remote code execution (RCE).
Unlike many critical server vulnerabilities that require administrative privileges, CVE-2026-45659 can be exploited by an authenticated user with relatively limited permissions. According to Microsoft’s advisory, an attacker needs only Site Member privileges to execute malicious code remotely on a vulnerable SharePoint server.
The flaw affects the following products:
Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Enterprise Server 2016
Because authenticated access is required, attackers would first need valid credentials or another method of gaining access to the environment. However, compromised credentials are frequently available through phishing attacks, password reuse, credential theft, or previous network compromises.
Microsoft released security updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition on May 21 to address this vulnerability, noting that the CVE had been inadvertently omitted from the May 2026 Security Updates.
Microsoft Initially Rated Exploitation Less Likely
When Microsoft released patches in May, the company assessed the vulnerability as “Exploitation Less Likely.”
However, CISA’s decision to add the flaw to its Known Exploited Vulnerabilities catalog demonstrates that attackers have successfully weaponized the vulnerability despite the initial assessment.
So far, neither Microsoft nor CISA has publicly disclosed technical details regarding the exploitation chain, the threat actors responsible, or the ultimate objectives behind the attacks. The absence of public exploit information suggests that investigations remain ongoing.
SharePoint Continues to Attract Threat Actors
Microsoft SharePoint has remained a frequent target for cybercriminals because it often contains sensitive corporate documents, authentication tokens, and connections to numerous enterprise services.
Successful compromise of a SharePoint server can provide attackers with opportunities to:
Access confidential business documents
Steal user credentials
Move laterally across corporate networks
Escalate privileges
Establish persistent access
Deploy ransomware
Exfiltrate sensitive information
On-premises SharePoint deployments generally face greater risk than cloud-hosted services, particularly when organizations delay security updates or expose servers directly to the internet.
Microsoft Reveals Complex Multi-Actor Intrusion
The renewed attention surrounding SharePoint security comes shortly after Microsoft disclosed findings from an extensive ransomware investigation that uncovered two unrelated threat actors operating simultaneously inside the same victim environment.
Initially believed to be a conventional ransomware incident, investigators later determined that multiple attackers had independently established access to the compromised network while using different persistence techniques and attack methods.
Microsoft said the overlapping activity complicated attribution and incident response, demonstrating how modern cyber intrusions increasingly involve multiple malicious actors rather than a single coordinated campaign.
Storm-2603 Linked to SharePoint Attacks
One of the intrusion clusters has been attributed to Storm-2603, a threat actor Microsoft associates with Warlock ransomware operations.
The group has reportedly targeted on-premises SharePoint environments since mid-2025 by exploiting publicly known vulnerabilities to obtain initial access.
During the investigation, Microsoft concluded that the attackers likely attempted to enter the network through CVE-2025-11371, a critical vulnerability affecting Gladinet Triofox.
Investigators observed requests for sensitive system files including win.ini and web.config, activity commonly associated with reconnaissance and attempts to verify local file inclusion weaknesses before expanding an intrusion.
Attackers Leveraged Legitimate Administrative Tools
After gaining access, the attackers deployed a combination of legitimate administrative utilities and malicious software to reduce the likelihood of detection.
Among the tools identified were:
Velociraptor
Cloudflare Tunnel
Zoho Assist
Secure Shell (SSH)
Visual Studio Code remote connections
By relying on software commonly used by system administrators, the attackers were able to blend malicious activity with normal administrative operations, making detection considerably more difficult.
Security researchers have increasingly observed ransomware operators adopting “living off the land” techniques, in which legitimate software is abused instead of deploying easily detectable malware.
Privilege Escalation and Defense Evasion
Microsoft also documented extensive privilege escalation efforts during the intrusion.
The attackers reportedly created new local and domain administrator accounts while deploying the vulnerable NSecKrnl.sys driver to interfere with endpoint security protections.
Such techniques are designed to weaken defensive tools, evade antivirus products, and maintain long-term persistence inside compromised environments before launching ransomware or stealing sensitive data.
A Second Threat Actor Emerges
Perhaps the most unusual discovery involved the presence of a completely separate threat actor operating within the same environment.
Microsoft’s investigators identified evidence of DLL side-loading techniques together with custom backdoors that appeared unrelated to Storm-2603.
The coexistence of two independent threat groups significantly complicated forensic analysis because indicators from one campaign overlapped with those of another, making it more difficult to reconstruct the complete attack timeline.
Further investigation eventually revealed that the attackers had expanded beyond the original victim, compromising a second organization through lateral movement associated with the ransomware operation.
Security Teams Urged to Prioritize Patching
The active exploitation of CVE-2026-45659 serves as another reminder that organizations should prioritize security updates for internet-facing collaboration platforms.
In addition to installing Microsoft’s latest security updates, defenders are encouraged to:
Review SharePoint authentication logs for suspicious activity.
Investigate unexpected administrator account creation.
Audit remote access services.
Monitor for unauthorized tunneling software.
Hunt for indicators of persistence.
Verify that endpoint security tools remain operational.
Review privileged account activity across Active Directory environments.
Organizations that suspect compromise should also conduct comprehensive incident response investigations to determine whether attackers established persistence before security updates were applied.
Outlook
CISA’s decision to add CVE-2026-45659 to the Known Exploited Vulnerabilities catalog highlights the evolving threat landscape facing organizations that rely on on-premises Microsoft SharePoint deployments. While Microsoft issued patches months earlier, the confirmation of active exploitation demonstrates that threat actors continue to capitalize on organizations that delay security updates.
Combined with Microsoft’s recent findings involving Storm-2603 and parallel threat activity, the latest disclosure illustrates how ransomware campaigns have evolved beyond simple encryption attacks into sophisticated, multi-stage intrusions focused on persistence, privilege escalation, and long-term access. As attackers continue to target widely deployed enterprise collaboration platforms, timely patch management, proactive threat hunting, and continuous monitoring remain critical components of organizational cyber defense.