CISA: SharePoint Vulnerability Being Used in Ransomware Attacks

The US Cybersecurity and Infrastructure Security Agency (CISA) has reported that ransomware operators have begun exploiting a remote code execution vulnerability in Microsoft SharePoint. At issue is CVE-2026-45659 — a flaw involving the deserialization of untrusted data. It allows an attacker with low privileges to execute arbitrary code on unpatched SharePoint servers.

The danger is compounded by the low complexity of the attack. As Microsoft noted back in May, when it released updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, an attacker doesn't need a deep knowledge of the system: they can achieve repeatable success with the same payload against a vulnerable component.

A three-day deadline to patch

CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog back on July 1, requiring federal civilian agencies to secure their servers within three days. The agency warned that flaws like this are a frequent attack vector and pose significant risks to the entire federal infrastructure.

In subsequent guidance, specialists were advised to monitor for signs of compromise, install the latest Microsoft patches and verify that they have been applied successfully, and shorten update cycles. In addition, they were advised to enable Windows Antimalware Scan Interface (AMSI) integration for SharePoint web applications and to leverage Microsoft Defender Antivirus detections to identify and remediate the consequences of a breach.

According to the Shadowserver research group, more than 8,500 SharePoint servers are accessible on the internet, over 200 of which remain unprotected against CVE-2026-45659.

Microsoft stays silent for now

Curiously, Microsoft itself has still not updated the vulnerability's description to note that it is being exploited — whereas CISA flagged the flaw as being used by ransomware operators on Tuesday. Since November 2021, the agency has recorded 14 actively exploited SharePoint vulnerabilities, eight of which were used specifically in ransomware attacks.

A similar situation has already played out before. In June, CISA confirmed that ransomware operators were exploiting a privilege escalation vulnerability in Microsoft Defender known as BlueHammer (CVE-2026-33825). It was used as a zero-day to gain access to the SAM database, where the password hashes of local accounts are stored. Information about the flaw, along with a sample exploit, was disclosed in early April by a researcher using the alias Nightmare Eclipse. But in this case, too, Microsoft never confirmed that it had been exploited in real-world attacks.

Source: Bleeping Computer