CVE-2026-45659 is a deserialization vulnerability in Microsoft SharePoint Server that enables remote code execution by authenticated attackers possessing at least Site Member permissions. The flaw is easy to exploit without requiring significant system knowledge and allows repeatable execution of arbitrary code on vulnerable servers. Microsoft released an out-of-band patch in late May 2026 to address this issue. CISA has observed active exploitation and mandated federal agencies to patch within three days. The vulnerability affects multiple SharePoint Server versions including Subscription Edition, 2019, 2016, and Enterprise Server 2016.

Successful exploitation permits authenticated attackers with minimal permissions to execute arbitrary code on SharePoint servers, potentially compromising the confidentiality, integrity, and availability of affected systems. Given SharePoint's role in enterprise document sharing and collaboration, exploitation could lead to significant operational disruption and data compromise. The vulnerability's ease of exploitation and active use by threat actors elevate the risk to critical levels.

Microsoft has released an official out-of-band security update in late May 2026 that addresses this vulnerability. Organizations should apply the provided patches immediately. CISA has included CVE-2026-45659 in its Known Exploited Vulnerabilities catalog and mandates patching within three days for federal agencies. No alternative mitigations or workarounds are indicated; applying the official patch is the primary remediation.