Microsoft patched CVE-2026-45659, a high-severity remote code execution vulnerability in SharePoint Server (CVSS 8.8), on May 21, 2026. The flaw stems from deserialization of untrusted data within Microsoft Office SharePoint and allows a network-based attacker to execute arbitrary code remotely on affected servers. Exploitation requires only a minimum of Site Member-level authenticated access — no elevated privileges — and carries low attack complexity with no user interaction needed. Affected products include SharePoint Server Subscription Edition (build 16.0.19725.20280), SharePoint Server 2019 (build 16.0.10417.20128), and SharePoint Enterprise Server 2016 (build 16.0.5552.1002). Microsoft currently assesses exploitation as "Less Likely" and no public proof-of-concept is known; however, the low exploitation barrier and SharePoint's history as a target for ransomware operators and nation-state actors make prompt patching a priority for organizations running on-premises deployments.
- High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-(opens in a new tab)
- Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Serv(opens in a new tab)
- Microsoft SharePoint Server Vulnerability Enables Remote Code Ex(opens in a new tab)