CISA Says Ransomware Gangs Exploit SharePoint RCE Flaw CVE-2026-45659
Summary
CISA says ransomware gangs are exploiting CVE-2026-45659, a low-privilege SharePoint RCE flaw; over 200 internet-exposed servers remain unpatched. CISA urges patching, verification and monitoring.
Key points
- CVE-2026-45659 is a deserialization flaw that can let low-privilege attackers run arbitrary code on unpatched SharePoint servers.
- Microsoft released updates for SharePoint Enterprise Server 2016, SharePoint Server 2019 and SharePoint Server Subscription Edition.
- CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities Catalog and set a three-day remediation deadline for federal civilian agencies.
- Shadowserver tracks more than 8,500 internet-exposed SharePoint servers, with over 200 still unpatched against the flaw.
- CISA urges teams to patch, verify installation and monitor affected servers; it also recommends AMSI integration and Microsoft Defender Antivirus detections.
- CISA also reported ransomware-gang exploitation of Microsoft Defender CVE-2026-33825, dubbed BlueHammer, while Microsoft had not confirmed in-the-wild exploitation.
Article Details
- Vulnerability Types
- Deserialization of untrusted data
- Remote code execution
- Privilege escalation
- Severity
- High
- Affected Versions
- SharePoint Enterprise Server 2016
- SharePoint Server 2019
- SharePoint Server Subscription Edition
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Apply Microsoft's latest patches and verify successful installation.
- Monitor affected servers for signs of exploitation.
- Enable AMSI integration for SharePoint web applications.
- Use Microsoft Defender Antivirus detections to detect and remediate compromise.
MITRE ATT&CK
T1003.002 · Security Account ManagerThe article says CVE-2026-33825 was targeted as a zero-day to access the Security Account Manager database, which contains local-account password hashes.T1068 · Exploitation for Privilege EscalationCVE-2026-33825 is described as a Microsoft Defender privilege escalation vulnerability.T1190 · Exploit Public-Facing ApplicationAttackers exploited the SharePoint flaw against internet-exposed servers to execute code on unpatched systems.
CVE
CVE-2026-33825The agency urged rapid patching and monitoring as more than 200 internet-exposed SharePoint servers remain unpatched, while also noting similar exploitation trends involving Microsoft Defender flaw CVE-2026-33825.CVE-2026-45659ransomware gangs are abusing the actively exploited Microsoft SharePoint remote code execution flaw CVE-2026-45659, which allows attackers with low privileges to run arbitrary code on unpatched servers.
People
Vendors
Products
Microsoft Defender Antimalware PlatformThe agency urged rapid patching and monitoring as more than 200 internet-exposed SharePoint servers remain unpatched, while also noting similar exploitation trends involving Microsoft Defender flaw CVE-2026-33825.Microsoft SharePointCISA confirmed that ransomware gangs are abusing the actively exploited Microsoft SharePoint remote code execution flaw CVE-2026-45659, which allows attackers with low privileges to run arbitrary code on unpatched