CISA Adds Actively Exploited Microsoft SharePoint RCE Vulnerability (CVE-2026-45659) to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity remote code execution (RCE) vulnerability in Microsoft SharePoint Server, tracked as CVE-2026-45659, to its Known Exploited Vulnerabilities (KEV) catalog. This action follows evidence of active exploitation of the flaw, which stems from the deserialization of untrusted data. Microsoft addressed the issue in May 2026, and CISA is urging federal agencies to apply the necessary patches immediately to mitigate risks.

Context

CVE-2026-45659 is a high-severity remote code execution vulnerability found in Microsoft SharePoint Server. It was identified due to the deserialization of untrusted data, which can allow attackers to execute arbitrary code. Microsoft released a patch for this vulnerability in May 2026, aiming to mitigate the risks associated with its exploitation.

Why it matters

The addition of CVE-2026-45659 to CISA's KEV catalog highlights the ongoing threat posed by cybersecurity vulnerabilities in widely used software. Active exploitation of this flaw can lead to significant security breaches, potentially compromising sensitive data and systems. Prompt action is crucial for federal agencies to protect their infrastructure from malicious attacks.

Implications

The exploitation of CVE-2026-45659 could lead to unauthorized access to sensitive information and disruption of services for organizations using Microsoft SharePoint. Federal agencies, along with private sector entities utilizing the software, may face heightened risks until the vulnerability is fully addressed. The situation underscores the importance of timely software updates and proactive cybersecurity measures.

What to watch

In the near term, federal agencies are expected to prioritize the application of the patch provided by Microsoft to address this vulnerability. Monitoring for further exploitation attempts will be critical as attackers may seek to capitalize on unpatched systems. Observers should also watch for updates from CISA regarding any new findings related to this vulnerability.