CISA: Microsoft SharePoint flaw now exploited in ransomware attacks

CISA confirmed today that ransomware gangs have begun abusing a high-severity Microsoft SharePoint remote code execution vulnerability, which has been flagged as actively exploited since early July.

Tracked as CVE-2026-45659, this security flaw stems from a deserialization of untrusted data weakness and allows attackers with low privileges to execute arbitrary code on unpatched SharePoint servers.

It can also be exploited in low-complexity attacks because (as Microsoft explained in May when it released security updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition) "an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component."

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities Catalog (KEV) on July 1, ordering Federal Civilian Executive Branch (FCEB) agencies to secure their servers within three days.

"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," the U.S. cybersecurity agency warned at the time.

In a subsequent advisory, the cybersecurity agency also urged security teams to monitor affected servers for signs of exploitation, apply Microsoft's latest patches, verify successful installation, and shorten patching cycles.

It also recommended enabling Windows Antimalware Scan Interface (AMSI integration for SharePoint web applications and using Microsoft Defender Antivirus (MDAV) detections to detect and remediate compromise.

Internet security watchdog group Shadowserver currently tracks over 8,500 Microsoft SharePoint servers exposed online, with over 200 of them unpatched against the CVE-2026-45659 vulnerability.

Internet-exposed SharePoint servers (Shadowserver)

While Microsoft has yet to update the CVE-2026-45659 advisory to tag it as exploited, CISA has now also flagged it as abused by ransomware gangs in a Tuesday update to the KEV Catalog.

Since November 2021, the cybersecurity agency has flagged 14 actively exploited Microsoft SharePoint vulnerabilities, with eight of them also exploited in ransomware attacks.

In June, CISA also confirmed that ransomware gangs now exploit a high-severity Microsoft Defender privilege escalation vulnerability (dubbed BlueHammer), which was also targeted as a zero-day to access the Security Account Manager (SAM) database, which contains password hashes for local accounts.

The security flaw (tracked CVE-2026-33825) was leaked by a security researcher known as "Nightmare Eclipse" in early April, together with proof-of-concept exploit code.

However, as with CVE-2026-45659, Microsoft has yet to confirm that the CVE-2026-33825 security flaw is being exploited in the wild.