CVE-2026-45659: Microsoft SharePoint Server Deserialization RCE Confirmed Actively Exploited — CISA KEV Addition; Ransomware Groups Observed Post-Exploitation

CISA added CVE-2026-45659 (CVSS 8.8) to the Known Exploited Vulnerabilities catalog on July 1, 2026, after confirming active in-the-wild exploitation of this deserialization-of-untrusted-data flaw affecting on-premises SharePoint Server Subscription Edition, 2019, and 2016. The bug requires only Site Member-level authentication and enables arbitrary remote code execution; incident response investigations have observed post-exploitation lateral movement via Cloudflare Tunnels, Zoho Assist, and SSH-over-VSCode for persistence, with exploitation chains attributed to financially motivated actors including Storm-2603 (Warlock ransomware). All organizations running on-premises SharePoint should validate patched build numbers farm-wide and hunt for w3wp.exe spawning command interpreters and new ASPX files under layouts paths.

All organizations running on-premises SharePoint should validate patched build numbers farm-wide and hunt for w3wp.exe spawning command interpreters and new ASPX files under layouts paths.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.