High‑Severity Authenticated RCE in Microsoft SharePoint (CVE‑2026‑45659) Threatens Enterprise Collaboration Platforms
What It Is – Microsoft disclosed CVE‑2026‑45659, a high‑severity remote code execution flaw in SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Enterprise Server 2016. The vulnerability stems from deserialization of untrusted data and can be triggered by an authenticated attacker without any user interaction.
Exploitability – Attack complexity is rated Low (AC:L). No public PoC or active exploitation reports exist, but the required authentication step is trivial in many on‑prem deployments that expose SharePoint to the internet. CVSS is expected to be ≥ 8.0.
Affected Products –
- SharePoint Server Subscription Edition (build 16.0.19725.20280)
- SharePoint Server 2019 (build 16.0.10417.20128)
- SharePoint Enterprise Server 2016 (build 16.0.5552.1002)
TPRM Impact –
- On‑prem SharePoint often stores confidential corporate documents, project plans, and HR records, making it a high‑value third‑party data repository.
- Compromise could enable lateral movement into other internal systems, exposing downstream vendors and customers to data leakage or ransomware.
Recommended Actions –
- Deploy Microsoft’s security updates for the affected SharePoint versions immediately.
- Verify that all SharePoint servers are behind a hardened perimeter (e.g., VPN, Zero‑Trust Network Access) and enforce MFA for any accounts with access.
- Conduct a focused audit of authentication logs for anomalous sign‑ins over the past 90 days.
- Review and restrict any third‑party integrations that may provide authenticated access to SharePoint APIs.
- Update your third‑party risk register to reflect the newly‑published vulnerability and re‑assess any vendors that rely on on‑prem SharePoint.
Source: Help Net Security – High‑severity SharePoint RCE bug patched by Microsoft (CVE‑2026‑45659)