Actively exploited in the wild
Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
Microsoft - SharePoint Server · Listed in the CISA KEV since 2026-07-01. This indicates confirmed attacks in production environments.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-45659
HighCVSS 8.8KEVExploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code remotely over a network.
Risk Assessment
An attacker with access to SharePoint can execute arbitrary code on the server, potentially leading to data theft or lateral movement within the corporate network.
Recommendation
Apply the Microsoft security update for SharePoint as recommended by the vendor.
Other vulnerabilities in Microsoft SharePoint
See all- CVE-2024-38094HighActively exploited
A vulnerability in Microsoft SharePoint allows for remote code execution. The NVD description does not provide technical details or attack vectors.
- CVE-2023-33157High
A vulnerability in Microsoft SharePoint allows for remote code execution, potentially leading to unauthorized access to the system.
- CVE-2020-1102High
Remote code execution vulnerability in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.
- CVE-2020-1024High
A remote code execution vulnerability in Microsoft SharePoint due to failure to check the source markup of application packages. An attacker could exploit it by uploading a specially crafted SharePoint application package. The update corrects how SharePoint checks source markup.
- CVE-2020-1023High
A remote code execution vulnerability in Microsoft SharePoint due to failure to check the source markup of application packages. An attacker could exploit it by uploading a specially crafted SharePoint application package. The update corrects how SharePoint checks source markup.
- CVE-2019-0604CriticalActively exploited
Microsoft SharePoint has a remote code execution vulnerability when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'.
Original NVD description (English source)
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS