Ransomware Campaigns Exploit SharePoint Flaw to Run Server Code

On August 19, 2026, the CISA Known Exploited Vulnerabilities Catalog carries a blunt status for Microsoft SharePoint CVE-2026-45659: exploitation is known, and ransomware campaign use is also known. CISA added the entry on July 1, more than five weeks after Microsoft fixed the flaw, and its current finding remains unreconciled with Microsoft’s public “exploitation not observed” assessment.

That unresolved mismatch is why the May flaw still matters now for SharePoint administrators. Installing the security update addresses the vulnerable code. It does not show whether an attacker used a stolen or compromised Site Member account before the farm reached a fixed build.

Ransomware Changes the Patch Priority

CISA added CVE-2026-45659 to KEV on July 1 and set a July 4 remediation deadline for US federal civilian agencies. Its current entry tells organizations to apply vendor mitigations and follow CISA’s forensic triage requirements. The catalog does not identify a ransomware family, affected organization, or attack date.

Microsoft’s CVE-2026-45659 advisory API presents an older and conflicting exploitation assessment. It still says exploitation is not observed and rates exploitation less likely. CISA’s later, authoritative exploitation record says the flaw is known to be used in ransomware campaigns.

The patch predates this warning. Microsoft released the fix in May 2026, then revised its record to explain that the CVE had been inadvertently omitted from the May security-update list. Customers who installed the applicable May update already received the fix.

Site Members Reach Server Code

The prerequisite is narrower than an unauthenticated internet exploit, but broad enough to matter in a compromised identity. Microsoft says, “Any authenticated attacker could trigger this vulnerability.” A Site Member account is sufficient. Administrator privileges and user interaction are not required.

The network-facing SharePoint component accepts attacker-controlled serialized data. Unsafe deserialization then reconstructs that data in a way that permits code execution on the server. Microsoft scores the flaw 8.8 and describes the attack as network reachable, low complexity, repeatable, and capable of high confidentiality, integrity, and availability impact.

Two source-backed paths separate SharePoint patch status from compromise status

Long description

Two horizontal paths distinguish remediation from incident scope. The first runs from a vulnerable SharePoint farm to the May 2026 security update and then to an edition-specific fixed build. The second runs from an authenticated Site Member account through unsafe deserialization to server code execution. CISA’s current record says the vulnerability is known to be used in ransomware campaigns, while neither CISA nor Microsoft identifies the operator, victims, or incident count.

Ransomware therefore does not need this CVE to supply initial access. The published mechanism starts with authenticated SharePoint access. A stolen session, phished password, reused credential, or another access path could satisfy that prerequisite, although the primary sources do not say which route the observed campaigns used.

Conflicting Records Leave Scale Unknown

Microsoft’s vendor record and CISA’s government record should remain separate in an investigation. Microsoft’s “No” exploitation field reflects its advisory state. CISA’s “Known” ransomware field reflects the current KEV determination. The sources do not reconcile their timestamps or explain the evidence behind the change.

Neither primary source quantifies exposed servers, successful intrusions, victims, or ransomware events. They also do not name tools, web shells, commands, filenames, network indicators, or post-exploitation behavior associated specifically with CVE-2026-45659. Detection cannot rely on a campaign-specific indicator list that has not been published.

This SharePoint issue is distinct from the CVE-2026-63520 and CVE-2026-63521 chain Nulltap covered on August 12. That chain described unauthenticated server code execution through two different flaws. CVE-2026-45659 requires an authenticated Site Member and has its own May update set.

Fixed Builds Start the Investigation

Patch every SharePoint server in the farm, run the SharePoint configuration process, and verify the farm build from the SharePoint Management Shell:

(Get-SPFarm).BuildVersion

The expected result is the applicable fixed build or a later fully supported build: Subscription Edition 16.0.19725.20280, SharePoint Server 2019 16.0.10417.20128, or SharePoint Server 2016 and Enterprise Server 2016 16.0.5552.1002. The Microsoft affected-product API binds those builds to KB5002863, KB5002870, and KB5002868 respectively. Those updates supersede KB5002853, KB5002854, and KB5002861. Later cumulative or security updates must still meet or exceed the listed build for that edition.

Then investigate backward from the first verified fixed-build time. Review SharePoint and IIS logs, authentication events, Site Member changes, unexpected worker-process children, modified application files, and outbound connections from the farm. Preserve those logs before rebuilding or rotating credentials. A passing build check proves the vulnerable code is replaced; a clean incident decision requires evidence that explains activity during the vulnerable interval.

The practical test has two results. Every server reports an edition-appropriate fixed or later build, and the retained telemetry accounts for authenticated SharePoint activity before that state was reached. If the first result passes while the second is unavailable, treat the farm as patched with historical exposure still unmeasured.

1-minute read

CISA’s current Known Exploited Vulnerabilities record says Microsoft SharePoint CVE-2026-45659 is known to be exploited and known to be used in ransomware campaigns. The flaw does not provide unauthenticated entry by itself. A Site Member account is enough to trigger low-complexity network code execution without user interaction.

Microsoft fixed the issue in May 2026. The minimum fixed builds are Subscription Edition 16.0.19725.20280 with KB5002863, SharePoint Server 2019 16.0.10417.20128 with KB5002870, and SharePoint Server 2016 or Enterprise Server 2016 16.0.5552.1002 with KB5002868.

Patch every server, complete the SharePoint configuration process, and run (Get-SPFarm).BuildVersion in the SharePoint Management Shell. The expected result is the edition’s fixed build or a later supported build. Verify every node rather than one administration server. Preserve SharePoint, IIS, authentication, and endpoint logs, then review the interval before the first confirmed fixed-build time for suspicious Site Member access, new memberships, unexpected worker-process children, changed application files, and outbound connections. Rotate exposed credentials and invalidate sessions when the evidence indicates misuse. The build result proves remediation state. The retained logs and telemetry determine whether authenticated access reached the vulnerable farm before remediation.

Microsoft’s advisory still says exploitation is not observed, while CISA’s later record says ransomware use is known. Neither source names the operators, victims, incident count, or campaign-specific indicators.