SharePoint CVE-2026-45659: Active RCE, CISA Sounds the Alarm

The CVE-2026-45659 flaw affecting Microsoft SharePoint Server has changed operational status: it is no longer just a vulnerability patched by the vendor, but a priority risk now confirmed as being actively exploited. According to The Hacker News coverage, the vulnerability was added to CISA’s KEV catalog after exploitation was observed in the wild. For security teams, Windows infrastructure teams, SharePoint administrators, and hybrid Microsoft 365 environments, this shift is decisive: an exposed and unpatched on-premises SharePoint server becomes a prime target for an initial compromise, potentially followed by an escalation of impact toward Active Directory, service accounts, application servers, and the internal information system.

The central point is not only the presence of a patch published by Microsoft in May 2026, but the fact that the U.S. defensive ecosystem, through CISA, now considers this flaw critical enough and exploited enough to require priority remediation for the entities concerned. In practice, this means that organizations that have retained on-premises SharePoint Server deployments, including in hybrid architectures with Microsoft 365, must immediately verify their versions, patching status, possible Internet exposure, and indicators of compromise on the affected Windows hosts.

The information publicly relayed at this stage establishes the following facts: CVE-2026-45659 is a remote code execution flaw in Microsoft SharePoint Server, a patch was published by Microsoft in May 2026, and the flaw was added to CISA’s KEV after active exploitation. The CVSS score is not confirmed in the elements provided here; it is therefore appropriate to refer to the official Microsoft advisory and CISA’s KEV entry for the exact value if it is published. The issue itself is clear: on an exposed SharePoint server, remote code execution can open the way to server takeover, credential collection, internal pivoting, and lateral movement in a corporate Windows environment.

Source mentioned: The Hacker News coverage of the addition of CVE-2026-45659 to CISA’s Known Exploited Vulnerabilities catalog, after confirmation of active exploitation. The technical reference source remains Microsoft’s official advisory as well as CISA’s KEV entry.

Affected versions

The elements communicated in the brief confirm that the vulnerability affects Microsoft SharePoint Server and that a fixed version was published by Microsoft in May 2026. However, the exact affected and fixed version numbers are not provided in the information available here. In a context of application security and active exploitation, it is preferable not to invent builds, update channels, or specific KBs.

On a strictly factual basis, we can therefore retain:

• Product concerned: Microsoft SharePoint Server in on-premises deployment.
• Vulnerability: CVE-2026-45659.
• Type: remote code execution.
• Status: patched by Microsoft in May 2026.
• Priority: high, because CISA added the flaw to its KEV catalog after active exploitation.

For production environments, best practice is to immediately establish an inventory of on-premises SharePoint servers, then compare each instance against Microsoft’s official advisory:

• major product version;
• installed update level;
• date of the last security patch;
• server role in the SharePoint farm;
• direct Internet exposure or exposure via reverse proxy;
• presence of interconnections with Active Directory, SQL Server, Exchange, ADFS, or other Microsoft components.

In many French-speaking organizations, this inventory is not trivial. Legacy deployments still remain in local authorities, healthcare institutions, industrial sites, and groups that have partially migrated to Microsoft 365 without fully removing on-premises components. For hosting providers or managed service providers operating on OVHcloud, Scaleway, or on dedicated infrastructures administered on behalf of clients, this visibility must be obtained quickly, including when SharePoint is no longer perceived as a prominently exposed service.

If the environment is managed by a provider, you must require:

• written confirmation of the presence or absence of Microsoft SharePoint Server;
• the exact version and patch level applied;
• the date the May 2026 patch was applied;
• proof of reboot or completion of the update process if required by the vendor;
• the security logs associated with the period preceding the patch.

In the absence of certainty about the version, the reasonable defensive posture is simple: any on-premises SharePoint Server not explicitly validated as patched must be considered potentially vulnerable.

Attack vector

CVE-2026-45659 is described as an RCE, that is, a remote code execution flaw. Even without detailing an exploitation mechanism not publicly confirmed in the elements provided, the technical consequences of such a class of vulnerability on SharePoint are well known to defensive teams: an attacker can target the application server itself to execute code in the context of the affected process, then exploit SharePoint’s central position in the information system to extend control.

SharePoint is not just an isolated website. In enterprise environments, it is generally part of a set of dependencies and trust relationships:

• authentication integrated with Active Directory;
• privileged service accounts;
• access to sensitive document libraries;
• integration with SQL Server;
• links with workflows, business components, connectors, and administration tools;
• external publishing via reverse proxy, WAF, or web front end.

This centrality makes SharePoint a particularly attractive entry point for a malicious actor. When an RCE flaw is exploited on an exposed server, several scenarios become realistic:

Initial compromise of an exposed server

The first scenario is that of a SharePoint server directly accessible from the Internet, or indirectly exposed via a front end. The attacker targets the web service in order to execute code on the Windows host. From there, they can drop tools, open a persistent session, create a scheduled task, install a web shell, or prepare a broader attack chain.

In an incident response context, the question is not only “is the patch applied?” but also “was the server compromised before the patch was applied?”. That is precisely what the addition to CISA’s KEV changes: the presence of a patch is no longer enough; the hypothesis of exploitation having already occurred must now be considered.

Application takeover and credential collection

Once code execution is obtained, the attacker may seek to recover:

• application secrets;
• service account credentials;
• configuration files;
• connection information to other components;
• tokens or session elements;
• artifacts useful for pivoting to other hosts.

On Windows, a compromised SharePoint server can also become a base for collecting system information: installed services, network connections, domain membership, execution account privileges, scheduled tasks, application logs, and traces of remote administration.

Lateral movement in a Windows / AD environment

The editorial brief rightly emphasizes lateral movement. This is a key point for CISOs and system administrators. A SharePoint server is not just an application asset; it is often a trusted node in a Windows domain. If the attacker obtains sufficient code execution, they may seek to:

• pivot to SQL Server;
• target reused service accounts;
• access network shares;
• explore domain trust relationships;
• prepare a broader compromise of Active Directory.

The risk is particularly significant in legacy architectures where service accounts have extensive rights, or when application servers are placed in network segments that are too permissive. In this type of environment, an RCE on SharePoint can become the initial event of a larger-scale attack.

Business impact

Beyond the purely technical aspect, the compromise of a SharePoint server often has a direct business impact:

• access to internal, HR, legal, or financial documents;
• alteration or deletion of content;
• unavailability of internal or extranet portals;
• degradation of trust in document workflows;
• a foothold for a ransomware campaign.

In hybrid Microsoft 365 environments, another risk lies in operational confusion: some teams assume that migration to the cloud has “reduced” the SharePoint perimeter, while on-premises servers still remain for compatibility, federation, archiving, or business integration needs. It is precisely these residual islands that can be forgotten in patching cycles while still remaining exposed.

Why the addition to KEV changes the priority

The Known Exploited Vulnerabilities catalog from CISA is not just a theoretical list. It signals vulnerabilities for which active exploitation has been observed or confirmed. For defense teams, this has several implications:

• the window of opportunity to patch “later” has closed;
• malicious actors have probably industrialized or shared exploitation chains;
• opportunistic scanners and automated targeting increase rapidly after media coverage;
• exposed assets become priorities in compromise campaigns.

In other words, a SharePoint flaw that has already been patched but is still untreated moves out of the “security backlog” category and into that of potential incident management.

Impact

The main impact associated with CVE-2026-45659 is remote code execution on Microsoft SharePoint Server. In a real environment, this impact unfolds across several levels.

Compromise of the SharePoint server

The first level is the complete or partial compromise of the application host. The attacker can execute commands, drop files, alter configuration, or maintain persistent access. This is often enough to degrade the confidentiality, integrity, and availability of the service.

Access to hosted data

SharePoint frequently hosts sensitive content: internal documentation, procedures, contracts, project files, deliverables, and sometimes regulated data. A compromise of the server can expose this content to exfiltration or manipulation.

Internal pivot

The third level, often the most critical, is the pivot to the rest of the information system. A compromised SharePoint server can serve as a beachhead to reach other Windows systems. This risk is reinforced when:

• inter-server flows are too open;
• technical accounts are over-privileged;
• network segmentation is insufficient;
• remote administration tools are present;
• logs are not centralized or are poorly monitored.

Ransomware risk

Without asserting a specific undocumented chain, it is reasonable to recall that an RCE on an exposed Windows server represents a classic entry point for extortion operations. An attacker who gains initial access on SharePoint may seek to elevate privileges, move laterally, disable protections, and encrypt critical resources.

For French organizations subject to continuity, data protection, or incident notification obligations, this risk must be assessed immediately. If Internet exposure is confirmed and the patch was not applied quickly after its publication in May 2026, a forensic review becomes relevant.

How to patch

The operational message is simple: apply without delay the Microsoft patch published in May 2026 for CVE-2026-45659 on all affected Microsoft SharePoint Server servers. The elements provided here do not detail the KB number, the target build, or the exact procedure specific to each edition; you must therefore rely on Microsoft’s official advisory and the corresponding SharePoint update documentation.

In a Windows Server environment, remediation generally goes through the Microsoft update channel used in the organization. The exact commands depend on the tooling in place, but the following approaches are the most common:

Via Windows Update / Microsoft Update

If the server uses Microsoft’s standard update mechanism, you must search for and install the security update published for SharePoint in May 2026, then reboot if necessary according to the vendor’s instructions.

Start > Settings > Windows Update

In a managed environment, this operation is often driven centrally rather than locally. You must then verify in the administration console that the SharePoint patch has indeed been approved, distributed, and installed on all affected nodes.

Via WSUS or centralized management

In many infrastructures, deployment goes through WSUS, Microsoft Endpoint Configuration Manager, or an equivalent solution. Teams must:

• identify the May 2026 SharePoint security update corresponding to CVE-2026-45659;
• approve emergency deployment;
• target all production, preproduction, and backup SharePoint servers;
• check installation success;
• verify reboots and post-maintenance availability.

Example PowerShell verification

The command below does not by itself confirm the remediation of CVE-2026-45659 without knowing the exact KB, but it can help inventory installed updates and document the server’s status.

Get-HotFix | Sort-Object InstalledOn -Descending

To search for a specific update when the exact number is known from the Microsoft advisory:

Get-HotFix -Id KBXXXXXXX

Replace KBXXXXXXX with the official identifier provided by Microsoft.

Verify the SharePoint build level

SharePoint farms often require an additional application-level verification after patch installation. Depending on the deployed version, administrators must check:

• the version displayed in central administration;
• the farm status;
• node consistency;
• the absence of failures in administration or configuration jobs.

It is also prudent to validate:

• the functioning of web applications;
• user access;
• workflows;
• third-party integrations;
• authentication or federation connectors.

Maintenance window and precautions

On SharePoint, patching must be treated as a sensitive operation:

• consistent prior backup;
• validation of dependencies;
• documented update order;
• rollback plan;
• enhanced monitoring after reboot.

For hosted or managed environments, particularly with providers relying on OVHcloud, Scaleway, or other private clouds, you must obtain proof of actual deployment and not just the announcement of a “patch campaign in progress.”

If the server is exposed to the Internet and the patch has not yet been applied, the most prudent measure is to immediately reduce exposure until remediation is completed.

Mitigation

When immediate application of the patch is not possible, mitigation measures do not replace the patch, but they can reduce the attack surface and limit risk for a short period. Given the active exploitation confirmed by the addition to CISA’s KEV, these measures must be considered transitional.

Reduce Internet exposure

The priority is to determine whether the SharePoint server is accessible from the Internet, directly or via a front end. If so:

• restrict access by IP filtering if possible;
• temporarily disable non-essential external publishing;
• limit access via VPN or bastion;
• block unnecessary paths at the reverse proxy or WAF level.

In some organizations, this simple reduction in exposure makes it possible to stop opportunistic attacks while the patch is being applied.

Strengthen monitoring of the SharePoint server

A potentially targeted server must be subject to increased monitoring:

• IIS logging;
• Windows events;
• unusual process creation;
• file writes in web directories;
• new or modified scheduled tasks;
• abnormal outbound network connections;
• suspicious authentication by service accounts.

For environments monitored by a SIEM, the alert level on SharePoint hosts and their immediate dependencies should be temporarily increased.

Harden service accounts

If application of the patch must wait for a maintenance window, it is useful to review without delay:

• the privileges of SharePoint service accounts;
• secret rotation;
• share access rights;
• Kerberos delegations or excessive permissions;
• the separation of administration and operations accounts.

This measure does not fix the flaw, but it can reduce the impact of an initial compromise.

Segment and filter internal flows

Lateral movement is a major concern. It is therefore advisable to quickly verify:

• the flows allowed between SharePoint and the rest of the information system;
• remote administration access;
• communications to domain controllers, SQL Server, and file servers;
• unnecessary ports still open.

Stricter segmentation can limit pivoting capability if a server is already compromised.

Detection

The move to the status of an actively exploited vulnerability requires both retrospective and prospective detection efforts. Even after patching, you must verify whether signs of compromise are present.

Indicators of compromise to look for

The public elements provided here do not detail specific IoCs published by Microsoft or CISA for CVE-2026-45659. It would therefore be imprudent to invent file names, paths, or request patterns. However, teams can look for behavioral indicators consistent with the compromise of a SharePoint server:

• unusual HTTP requests in IIS logs, particularly to SharePoint paths rarely used in normal operation;
• spikes in HTTP responses with 500, 403, or other abnormal codes around exploitation attempts;
• unexpected creation or modification of files under web application directories;
• presence of unrecognized scripts or binaries on the server;
• launch of child processes from web components or application services;
• unusual outbound connections from the SharePoint server to the Internet or to unusual internal segments;
• abnormal authentications using SharePoint service accounts;
• scheduled tasks, services, or persistence mechanisms recently created;
• disabling or alteration of local security tools.

Log sources to prioritize

For an initial investigation, the following sources are priorities:

• IIS logs;
• Windows event logs, notably security, system, and application;
• native SharePoint logs;
• EDR telemetry;
• reverse proxy or WAF logs;
• Active Directory authentication logs;
• network logs from firewalls and outbound proxies.

Examples of system checks

These commands do not constitute IoCs specific to CVE-2026-45659, but they can help with the rapid review of a potentially compromised Windows server:

Get-Process | Sort-Object ProcessName Get-ScheduledTask | Select-Object TaskName,TaskPath,State Get-Service | Sort-Object Status,DisplayName netstat -ano Get-ChildItem -Path "C:\inetpub\" -Recurse | Sort-Object LastWriteTime -Descending

These checks must be correlated with knowledge of the server, the installed applications, and recent legitimate changes. An unusual modification date, an unexpected binary, or an undocumented process should trigger deeper investigation.

When to trigger incident response

A formal incident response should be considered if at least one of the following cases is observed:

• an exposed SharePoint server left unpatched for a significant period after publication of the patch;
• traces of abnormal requests compatible with exploitation attempts;
• suspicious files or processes on the host;
• unexplained outbound network activity;
• abnormal use of service accounts;
• signs of pivoting to other Windows systems.

In the French context, it may also be relevant to follow communications from CERT-FR if a note or alert relay is published on this subject, particularly for administrations, operators, and structures subject to strengthened security requirements.

Why Windows teams, hybrid M365 teams, and CISOs must react immediately

The CVE-2026-45659 case illustrates a pattern that is now classic but still underestimated: a critical vulnerability is patched, then a few weeks or months later moves into the category of priority threats as soon as active exploitation is confirmed. This gap between patch publication and real-world exploitation mainly penalizes organizations that maintain a large or poorly inventoried on-premises estate.

For Windows infrastructure teams, the issue goes beyond simple patch management. SharePoint must be treated as a high-value application server, potentially interconnected with critical domain components. For administrators of hybrid Microsoft 365 environments, the risk is that of blind spots: a well-governed cloud tenant does not compensate for a forgotten local SharePoint server or one maintained for compatibility. For CISOs, the addition to the KEV means that an immediate status of the affected assets, proof of remediation, and, if necessary, a compromise hunt must be requested.

From a governance standpoint, this flaw also reminds us of the importance of:

• a reliable inventory of exposed components;
• prioritization based on active exploitation, not only theoretical severity;
• monitoring adapted to Windows application servers;
• network segmentation that is actually enforced;
• a regular review of service accounts and AD dependencies.

The initial source relayed by The Hacker News should be read as a signal of operational urgency, but the working reference remains the official Microsoft advisory supplemented by the CISA KEV entry. If your Microsoft SharePoint Server servers are not explicitly confirmed as patched since the May 2026 publication, they must be considered priorities, their exposure reduced, and compromise verification launched immediately. To complement this response with hardening measures and defensive hygiene, a visit to FailleWeb’s /categorie/pratiques category is particularly relevant.