Microsoft has released security updates for a serious SharePoint vulnerability that could allow attackers to remotely execute malicious code using low level account access.
Quick Summary – TLDR:
- Microsoft patched CVE-2026-45659, a SharePoint remote code execution vulnerability with a CVSS score of 8.8.
- The flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.
- Attackers only need authenticated Site Member level permissions to exploit the issue.
- Microsoft says there is currently no evidence of active exploitation, but organizations are urged to patch immediately.
What Happened?
Microsoft has fixed a newly disclosed remote code execution vulnerability in SharePoint that could allow authenticated attackers to run arbitrary code on vulnerable servers. The security issue, tracked as CVE-2026-45659, was disclosed as part of Microsoft’s May 2026 Patch Tuesday rollout.
The company described the flaw as a deserialization of untrusted data vulnerability, a type of security weakness that has repeatedly affected SharePoint and other enterprise software platforms in recent years.
🚨 BREAKING: Microsoft releases critical patches for SharePoint RCE flaw CVE-2026-45659. The vulnerability, with a CVSS score of 8.8, allows remote code execution without special conditions. Update your servers now! #NerdieNews #CyberSecurity #BreakingNews #InfoSec #Microsoft pic.twitter.com/SOFxaF3QiD
— NerdieNews (@NewsNerdie) May 26, 2026
Microsoft Warns of Serious SharePoint Risk
According to Microsoft, the vulnerability allows attackers to execute code remotely over a network after authenticating with low privilege credentials. The flaw received a CVSS score of 8.8 and has been classified as an important severity issue.
The company explained that attackers only require Site Member permissions to trigger the vulnerability. No administrator access or elevated privileges are needed, which significantly increases the potential risk for organizations using on premises SharePoint deployments.
Microsoft stated:
Security researchers say this type of attack works by sending specially crafted serialized data to the SharePoint server. If the server processes the malicious payload without proper validation, attackers can hijack the deserialization process and execute arbitrary commands.
Vulnerability Continues Ongoing SharePoint Security Concerns
The newly patched flaw follows several SharePoint vulnerabilities disclosed earlier this year. Security experts have repeatedly warned that SharePoint remains a high value target for attackers because it is widely used for enterprise document management and internal collaboration.
Earlier in 2026, Microsoft patched another SharePoint vulnerability, CVE-2026-20963, which was later upgraded to a critical severity rating after researchers confirmed unauthenticated exploitation possibilities. That flaw was eventually added to CISA’s Known Exploited Vulnerabilities catalog.
Last month, Microsoft also addressed a separate SharePoint spoofing issue identified as CVE-2026-32201, which the company confirmed had already been exploited in real world attacks.
Although Microsoft currently says CVE-2026-45659 is less likely to be exploited, security professionals are advising organizations not to delay updates due to the increasing trend of attackers weaponizing SharePoint vulnerabilities.
Affected SharePoint Versions
Microsoft released patches for all supported affected versions, including:
- SharePoint Server Subscription Edition
- SharePoint Server 2019
- SharePoint Enterprise Server 2016
The company also confirmed that both SharePoint Server 2016 and SharePoint Enterprise Server 2016 users should install the same update package.
Microsoft credited a security researcher known as MEOW for discovering and responsibly reporting the vulnerability.
Security Teams Advised to Patch Immediately
Security teams are strongly encouraged to apply Microsoft’s latest updates as soon as possible. Experts also recommend reviewing SharePoint user permissions and limiting unnecessary Site Member access wherever possible.
Organizations are additionally advised to monitor SharePoint logs for suspicious activity, deploy web application firewall protections, and isolate SharePoint infrastructure from critical internal systems to reduce the risk of lateral movement in case of compromise.
At the time of publication, Microsoft said there is no public exploit code available and no confirmed evidence of attacks exploiting the flaw in the wild.
SQ Magazine Takeaway
I think this vulnerability is another reminder that SharePoint continues to be one of the most attractive enterprise targets for attackers. The worrying part here is that hackers do not need administrator access to potentially compromise servers. Low privilege access combined with remote code execution is already dangerous enough for large organizations.
Even though Microsoft says there are no active attacks yet, history shows SharePoint flaws often become weaponized very quickly after disclosure. Companies running on premises SharePoint servers should treat this update as a high priority fix.
