The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning organizations worldwide to address a critical vulnerability in Microsoft SharePoint that is now being actively exploited by ransomware groups. This vulnerability, identified as CVE-2026-45659, allows attackers with low privileges to execute arbitrary code on unpatched servers, potentially leading to complete system compromise.
Microsoft patched this flaw in late May, but its exploitation has been observed since early July. The vulnerability is classified as a deserialization of untrusted data issue and carries a CVSS score of 8.8, indicating significant severity. CISA added CVE-2026-45659 to the Known Exploited Vulnerabilities (KEV) catalog on July 1st, triggering immediate action requirements for Federal Civilian Executive Branch (FCEB) agencies.
The urgency stems from the fact that ransomware actors are actively leveraging this vulnerability in ongoing attacks. While CISA has not released specific details about the targeted organizations or the particular ransomware strains involved, the agency’s warning highlights the immediate threat posed to systems running vulnerable SharePoint instances. The ease of exploitation – requiring only low privileges – makes it particularly concerning.
CISA has mandated that FCEB agencies secure their SharePoint servers within three days of the vulnerability’s addition to the KEV catalog, emphasizing the critical need for rapid remediation efforts. This directive underscores the agency’s focus on proactively addressing exploited vulnerabilities before they can cause widespread disruption and data breaches.
Organizations are strongly advised to apply Microsoft’s patch released in late May as a primary defense measure. Furthermore, conducting thorough vulnerability assessments of SharePoint environments is essential to identify and mitigate any remaining risks. Beyond patching, organizations should review their SharePoint configurations for potential weaknesses and implement robust access controls to limit the impact of a successful attack. Continuous monitoring and diligent security practices remain crucial for maintaining a robust cybersecurity posture against evolving threats like this actively exploited RCE vulnerability.
Sources: