CISA Orders 3-Day Patch for SharePoint Vulnerability

8.8 is the severity score now attached to an actively exploited Microsoft SharePoint vulnerability, and CISA is giving federal agencies only three days to fix it.

The US Cybersecurity and Infrastructure Security Agency said Wednesday that threat actors are exploiting CVE-2026-45659, a high-severity remote code execution flaw in Microsoft SharePoint Server, according to SecurityWeek. Microsoft patched the bug in late May through an out-of-band security update, but CISA’s warning means unpatched servers have moved from routine exposure to confirmed attack surface.

CISA puts CVE-2026-45659 on the exploited list with an 8.8 severity score

CVE-2026-45659 is a deserialization of untrusted data bug. In practical terms, SharePoint mishandles data in a way that can let an authenticated attacker execute arbitrary code on a vulnerable server.

Microsoft said the attacker needs only Site Member permissions and no other elevated privileges. That detail matters because Site Member access is far below administrator control, yet Microsoft says it can be enough to trigger the flaw.

“because an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.”

That Microsoft assessment is the sharpest part of the advisory. The flaw is not described as requiring deep system knowledge, unusual access, or fragile conditions.

The affected products are:

CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalog on Wednesday. Under BOD 26-04, federal agencies must patch the flaw within three days.

For private companies, that deadline is not binding. It is still a useful signal. CISA does not add flaws to the KEV catalog for theoretical risk. It does so when exploitation is observed.

SharePoint servers are urgent targets because the patch window has collapsed

Microsoft SharePoint sits inside document sharing, intranet, and collaboration workflows across enterprises and government environments. That makes a server-side code execution flaw more than a patch-management nuisance.

XOOMAR analysis: a remote code execution flaw on a collaboration server can matter because the compromised host may sit near sensitive files, business records, internal workflows, and authenticated user activity. The exact blast radius depends on how the SharePoint server is deployed, what it can reach, and what privileges attackers obtain after exploitation.

CISA has not disclosed who is exploiting CVE-2026-45659, how many organizations may be affected, or what post-exploitation activity has been seen. SecurityWeek also noted there had been no public reports of in-the-wild exploitation before CISA’s warning.

That lack of public detail cuts both ways. It avoids speculation, but it also leaves defenders without attacker names, victim profiles, or indicators of compromise tied to this specific campaign.

Microsoft’s enterprise footprint is the broader backdrop here. The company’s central role in workplace infrastructure is also visible in XOOMAR’s coverage of Microsoft’s $2.5B enterprise AI push and Microsoft Frontier’s AI rollout fight. SharePoint is a different problem, but it shows the same operational truth: when core Microsoft infrastructure needs urgent action, the burden lands fast on IT and security teams.

This is also not the first recent SharePoint security alarm. SecurityWeek reported that Microsoft patched a SharePoint bug exploited as a zero-day in April, and CISA warned in March that another Microsoft product flaw was being targeted in the wild.

Federal agencies have three days, everyone else has a smaller margin than they think

The immediate task is narrow: confirm whether affected SharePoint Server deployments received Microsoft’s late-May out-of-band patch for CVE-2026-45659.

Organizations should not rely on assumptions from normal patch cycles. Out-of-band updates can sit outside routine monthly review patterns, and CISA’s exploited status means any delay now carries a different risk profile.

A practical response starts with four checks:

• Inventory: Identify all SharePoint Server Subscription Edition, SharePoint Server 2019, SharePoint Server 2016, and SharePoint Enterprise Server 2016 instances.
• Patch validation: Confirm the relevant Microsoft update is installed, not merely approved or queued.
• Exposure review: Prioritize servers reachable from the internet or broad user populations.
• Compromise review: Check SharePoint hosts for suspicious authentication activity, web server requests, unexpected process execution, new files, configuration changes, or unusual outbound traffic.

Those review points are not specific CISA indicators for CVE-2026-45659. CISA has not published attack details in the source material. They are the minimum generic checks defenders would use when a server-side RCE moves into the exploited category.

The absence of exploit details also means security teams should track vendor and agency updates closely. Microsoft advisories, CISA KEV changes, and any later indicators of compromise will determine whether this remains a fast patching event or widens into incident response across exposed SharePoint estates.

For now, the highest-confidence takeaway is simple: CVE-2026-45659 is patched, exploitable, and already being used. The next signal to watch is whether CISA or Microsoft releases technical indicators, attack scope, or evidence that exploitation is spreading beyond the activity already confirmed.

Impact Analysis

• Federal agencies have only three days to patch the actively exploited SharePoint flaw.
• The vulnerability can allow remote code execution with only Site Member permissions.
• Unpatched SharePoint servers are now confirmed attack targets rather than theoretical risks.