Microsoft SharePoint Server Deserialization RCE (CVE-2026-45659) | MSSP Advisory

Risk Assessment

CISA has added CVE-2026-45659, a Microsoft SharePoint Server deserialization vulnerability, to the Known Exploited Vulnerabilities catalog, meaning active exploitation is already underway in the wild. An authenticated attacker can execute arbitrary code remotely, which in a SharePoint environment often means access to file stores, internal communications, and credentials that open doors deeper into a network. The July 4 patch deadline is a compliance floor, not a safety target.

If any of your clients run on-premises SharePoint Server, you have an obligation to notify them today, not at your next scheduled check-in, because code execution on SharePoint translates directly to lateral movement opportunities across the rest of their environment. Your own stack is also at risk if you use SharePoint internally for documentation, runbooks, or client-facing portals, since a compromised MSSP SharePoint instance exposes every credential and process document your team has stored there.