CVE-2026-45659
Actively exploited. CVE-2026-45659 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-07-01) — exploitation has been observed in the wild, and US federal agencies are required to remediate it under BOD 22-01. Treat patching as urgent.
Public exploit code is available. Proof-of-concept or working exploit code for CVE-2026-45659 is indexed in GitHub PoC. Expect opportunistic scanning and exploitation attempts — prioritize remediation.
Number: AL26-015 Date: July 2, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Details The Canadian Centre for Cyber Security (Cyber Centre) is aware of active exploitation of a vulnerability affecting Microsoft SharePoint Server. In response to the Microsoft security advisory, released on May 21, 2026 Footnote 1 , the Cyber Centre issued AV26-456 Footnote 2 Update 1 on May 21, 2026. Tracked as CVE-2026-45659 Footnote 3 , this vulnerability is a critical Deserialization of Untrusted Data (CWE-502) Footnote 4 vulnerability affecting multiple versions of Microsoft SharePoint Server and could allow a low privileged remote attacker to execute remote code. This vulnerability was added to the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog Footnote 5 on July 1, 2026. Suggested actions The Cyber Centre recommends that organizations upgrade affected Microsoft SharePoint instances to a fixed version: Affected Product Affected Versions Fixed Versions Microsoft SharePoint Enterprise Server 2016 16.0.0 before 16.0.5552.1002 16.0.5552.1002 Microsoft SharePoint Server 2019 16.0.0 before 16.0.10417.20128 16.0.10417.20128 Microsoft SharePoint Server Subscription Edition 16.0.0 before 16.0.19725.20280 16.0.19725.20280 The Cyber Centre recommends organizations: Identify all on-premises SharePoint Server instances, particularly those exposed to the internet. Use or upgrade to supported versions of on-premises Microsoft SharePoint Server. Apply the latest security updates from Microsoft. Important note: Microsoft SharePoint Enterprise Server 2016
CSIRTS triage
- What
- This vulnerability involves deserialization of untrusted data.
- Who is affected
- Deployments of Microsoft SharePoint Server are affected.
- Urgency
- Remediation is urgent due to active exploitation and critical severity.
- Action
- Apply the latest security updates from Microsoft.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-45659
Get an email if CVE-2026-45659 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Exploitation confirmedAlready exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 87% of all EPSS-scored CVEs.
Exploit availability
Public exploit or proof-of-concept code for CVE-2026-45659 is indexed in these free datasets. Available exploit code raises real-world risk independent of the CVSS score.
- GitHub PoCPublic proof-of-concept repositories on GitHub reference this CVE.look it up ↗
Advisory coverage (4)
- criticalexploitedAL26-015 - Critical vulnerability impacting Microsoft SharePoint Server – CVE-2026-45659cccs · 2026-07-02
- high[UPDATE] [high] Microsoft SharePoint Server 2016 and SharePoint Server 2019: Vulnerability allows code executi…cert-bund · 2026-07-02
- highexploitedCISA Adds One Known Exploited Vulnerability to Catalogcisa · 2026-07-01
- criticalexploitedCVE-2026-45659: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerabilitycisa-kev · 2026-07-01
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-45659)