Critical Deserialization Flaw in Microsoft SharePoint Server Added to CISA KEV Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has formally recognized a significant security threat by adding CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) Catalog. This move signals that the vulnerability is no longer just a theoretical risk; it is actively being leveraged by threat actors in real-world environments.

The flaw is classified under CWE-502 (Deserialization of Untrusted Data). In technical terms, this means the application fails to sufficiently validate or sanitize incoming data streams before transforming them back into live objects. For organizations running on-premises Microsoft SharePoint Server deployments, this represents a high-stakes entry point for attackers.

Technical Breakdown: The Mechanics of the Exploit

At its core, the vulnerability stems from how SharePoint handles serialized objects. In a typical workflow, an application converts complex data structures into a byte stream for storage or transmission, then “deserializes” them back into objects to be used by the system. However, in the case of CVE-2026-45659, an authenticated attacker can inject a maliciously crafted payload into this stream.

When the SharePoint server attempts to process this tainted data, the unintended execution path triggers Remote Code Execution (RCE). Once the attacker achieves RCE, the implications are severe: they can manipulate sensitive SharePoint content, pivot laterally through the internal network, or establish long-term persistence within the enterprise infrastructure.

While there is currently no confirmed link between this specific exploit and widespread ransomware campaigns, the fact that it has appeared in the KEV catalog indicates that active exploitation is occurring in the wild. This makes it a primary target for sophisticated actors looking to breach enterprise collaboration platforms.

Regulatory Mandates and Remediation Timelines

Following the official addition to the KEV catalog on July 1, 2026, CISA has issued a strict remediation directive under Binding Operational Directive (BOD) 26-04. This directive mandates that federal civilian agencies patch the vulnerability by July 4, 2026.

While this directive specifically targets federal agencies, it serves as a critical bellwether for the private sector. Organizations are strongly urged to:

• Apply Vendor Patches: Immediately deploy the security updates provided by Microsoft to address the underlying deserialization flaw.
• Follow Forensics Guidelines: Adhere to CISA’s Forensics Triage Guidelines to ensure that if a compromise has already occurred, incident responders can accurately perform post-compromise analysis.
• Verify Cloud Mitigations: For organizations using cloud-hosted SharePoint services, follow the specific guidance in BOD 26-04 to ensure that vendor-side security controls are active and effective.

Defense-in-Depth Strategies

Because this vulnerability requires authentication, it is rarely a standalone attack. Threat actors typically “chain” this exploit with other techniques, such as phishing, credential harvesting, or exploiting previously compromised accounts, to gain the necessary permissions to reach the SharePoint interface.

To build a resilient defense, security teams should move beyond simple patching and adopt a layered security posture:

• Attack Surface Reduction: Identify and secure all internet-facing SharePoint instances. If immediate patching is not possible, consider disabling the affected services temporarily to minimize exposure.
• Identity Security: Implement robust Multi-Factor Authentication (MFA) to hinder an attacker’s ability to gain the authenticated access required to trigger the exploit.
• Continuous Monitoring: Monitor authentication logs for anomalies and keep a close watch on SharePoint application logs for unusual activity that might indicate an attempted deserialization attack.

The inclusion of CVE-2026-45659 in the KEV catalog serves as a stark reminder that enterprise collaboration tools—which act as central hubs for sensitive corporate data—are increasingly becoming the primary targets for high-impact cyber intrusions. Proactive threat hunting and rapid patch management are no longer optional; they are essential components of modern cyber defense.