CVE-2026-45659: Microsoft SharePoint Server Deserialization RCE — Active Exploitation Detected

Vulnerability Overview

CVE-2026-45659 is a critical deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint Server. The root cause is SharePoint's failure to validate or sanitize serialized .NET objects submitted to its web endpoints before deserializing them. An unauthenticated or low-privileged remote attacker can craft a malicious serialized payload and submit it to a vulnerable SharePoint endpoint, triggering arbitrary code execution in the context of the SharePoint application pool — typically with significant server-side privileges.

The impact is severe: successful exploitation yields remote code execution (RCE) on the SharePoint host, enabling lateral movement, credential theft, data exfiltration, and ransomware staging within the enterprise environment.

Affected Software

• Vendor: Microsoft
• Product: SharePoint Server

Specific affected version ranges have not yet been published. Organizations running any on-premises SharePoint Server deployment should treat themselves as vulnerable until Microsoft releases authoritative version guidance.

Exploitation Status

This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Disclosed on 2026-07-01, the rapid KEV listing indicates threat actors moved quickly to weaponize this flaw. No patch date has been confirmed at time of writing. Defenders should treat this as an emergency-priority item: assume exploitation attempts are already occurring against internet-facing and internal SharePoint deployments.

The KEV designation also means U.S. federal agencies face mandatory remediation timelines under BOD 22-01. All organizations should follow suit regardless of regulatory obligation.

Detection Coverage

The df00tech detection platform ships purpose-built queries for CVE-2026-45659 across seven SIEM platforms:

• Microsoft Sentinel (KQL) — correlates anomalous HTTP POST patterns to SharePoint web service endpoints with oversized or malformed body payloads indicative of serialized .NET object injection.
• Splunk (SPL) — hunts IIS/SharePoint access logs for requests targeting deserialization-susceptible endpoints combined with process spawn events from the w3wp.exe worker process.
• Elastic (EQL) — uses sequence detection to link inbound web requests to suspicious child process creation or outbound network connections originating from SharePoint worker processes.
• IBM QRadar (AQL) — queries flow and log sources for SharePoint endpoint hits paired with anomalous process execution chains on the host.
• Sumo Logic — parses SharePoint ULS and IIS logs for error patterns and payload markers consistent with deserialization gadget chain delivery.
• Google Chronicle (YARA-L) — rule matches on network telemetry and endpoint events linking SharePoint web traffic to post-exploitation indicators such as unexpected outbound connections.
• CrowdStrike (CQL) — leverages EDR telemetry to detect w3wp.exe spawning shells, scripting engines, or reconnaissance tooling following inbound web requests to SharePoint endpoints.

Detection logic across all platforms focuses on the observable behaviors of this attack class: crafted requests to SharePoint web endpoints, anomalous worker-process activity, and post-exploitation process chains — providing coverage even where payload signatures may vary.

Next Steps

Deploy Microsoft patches immediately upon release and consider temporarily restricting external access to SharePoint web endpoints where operationally feasible. Review your WAF rules for .NET deserialization payload signatures as a compensating control. For full query logic, MITRE ATT&CK mappings, and purple team playbooks, see the CVE-2026-45659 detection page.