CISA adds actively exploited SharePoint RCE flaw to KEV catalog after Microsoft downplayed risk

Summary

CISA has added CVE-2026-45659, a remote code execution vulnerability in on-premises Microsoft SharePoint Server, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. The flaw, stemming from an insecure deserialization issue, affects SharePoint Server Subscription Edition, 2019, and 2016. This contradicts Microsoft's earlier assessment that exploitation was 'less likely.' Attackers need only a valid SharePoint account to execute code on vulnerable on-premises servers.

Source

bskyCISA adds actively exploited SharePoint RCE flaw to KEV catalog after Microsoft downplayed risktheregister.com