[UPDATE] [high] Microsoft SharePoint Server 2016 and SharePoint Server 2019: Vulnerability allows code execution

highpublic exploitCVE-2026-45659

A remote, authenticated attacker can exploit a vulnerability in Microsoft SharePoint Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint to execute arbitrary program code.

CSIRTS triage

vendor: Microsoft product: SharePoint Server Remote code executionaffected: 2016, 2019

What: A vulnerability allows a remote, authenticated attacker to execute arbitrary program code.
Who is affected: Deployments of Microsoft SharePoint Server 2016 and 2019 are affected.
Urgency: Remediation is high priority due to the high severity and active exploitation of the vulnerability.
Action: Update to the latest version of SharePoint Server to mitigate the vulnerability.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch SharePoint Server

Get an email when a new SharePoint Server advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-07-02
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1652

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Exploitation confirmedCVE-2026-45659Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 95% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-45659	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

criticalexploited2026-009: Critical Vulnerabilities in Microsoft SharePointcert-eu
unknownexploitedCISA Urges SharePoint Hardening After New Exploitationscisa
criticalexploitedAL26-015 - Critical vulnerability impacting Microsoft SharePoint Server – CVE-2026-45659cccs
highexploitedCISA Adds One Known Exploited Vulnerability to Catalogcisa
criticalexploitedCVE-2026-45659: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerabilitycisa-kev

Recent advisories for Microsoft SharePoint Server

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-70326: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacke…nvd · 2026-08-11
highCVE-2026-70324: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacke…nvd · 2026-08-11
mediumCVE-2026-58639: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacke…nvd · 2026-08-11
mediumCVE-2026-64916: Microsoft SharePoint Server Spoofing Vulnerabilitymsrc · 2026-08-11
highCVE-2026-70326: Microsoft SharePoint Server Elevation of Privilege Vulnerabilitymsrc · 2026-08-11
mediumCVE-2026-62839: Microsoft SharePoint Server Spoofing Vulnerabilitymsrc · 2026-08-11