The United States Cybersecurity and Infrastructure Security Agency (CISA) confirmed on August 11, 2026, that the high-severity vulnerability CVE-2026-45659 affecting Microsoft SharePoint is now being exploited by ransomware groups. This update to the Known Exploited Vulnerabilities (KEV) catalog marks a significant escalation: the flaw, which active exploitation was reported as early as July 1, moves from "Unknown" to "Known" regarding its use in ransomware campaigns.

An easily exploitable deserialization vulnerability

The vulnerability CVE-2026-45659 results from an issue of deserialization of untrusted data (CWE-502) in Microsoft Office SharePoint Server. According to data from the NVD, it has a CVSS 3.1 score of 8.8 (HIGH) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Specifically, any authenticated attacker with at least "Site Member" permissions can execute remote code on an unpatched SharePoint server. Microsoft emphasizes that the complexity of the attack is low: the attacker does not require deep knowledge of the system and can achieve reproducible success with their payload.

The affected versions are:

  • SharePoint Enterprise Server 2016 (versions prior to 16.0.5552.1002)
  • SharePoint Server 2019 (versions prior to 16.0.10417.20128)
  • SharePoint Server Subscription Edition (versions prior to 16.0.19725.20280)

Microsoft had released the patches on May 21, 2026, although the CVE was accidentally omitted from the security updates in May initially.

Timeline of an escalation

The evolution of this vulnerability into ransomware follows a specific timeline:

  • May 21, 2026: Microsoft releases patches for CVE-2026-45659.
  • May 22, 2026: The NVD officially publishes the CVE entry.
  • July 1, 2026: CISA adds the flaw to its KEV catalog, ordering federal agencies (FCEB) to secure their servers in three days (deadline July 4), in accordance with Binding Operational Directive (BOD) 26-04. At this stage, the use in ransomware campaigns is marked as "Unknown."
  • July 2, 2026: BleepingComputer reports active exploitation; Shadowserver counts more than 10,000 SharePoint servers exposed on the Internet.
  • July 14, 2026: A third SharePoint vulnerability (CVE-2026-56164) is added to the KEV.
  • July 15, 2026: CISA issues an alert covering three actively exploited SharePoint vulnerabilities — CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 — describing post-exploitation activities including the theft of IIS machine keys and establishing persistence to deploy malware. Shadowserver then records nearly 10,000 exposed servers, including over 800 unpatched against CVE-2026-32201 and CVE-2026-45659.
  • August 11, 2026: CISA updates the KEV to report that CVE-2026-45659 is now exploited in ransomware campaigns. Shadowserver indicates that over 8,500 SharePoint servers remain exposed, with more than 200 still unpatched against this vulnerability.

Notably, Microsoft has not yet updated its advisory to tag CVE-2026-45659 as actively exploited in the wild, similar to what happened with the Defender flaw "BlueHammer" (CVE-2026-33825).

SharePoint: A prime target for ransomware

This confirmation aligns with an ongoing trend. Since November 2021, CISA has identified 14 actively exploited SharePoint vulnerabilities, of which 8 later ended up being used in ransomware attacks. As of July 15, this number was 11, with 7 — indicating that the situation has worsened within a month.

Additionally, on July 22, 2026, a fifth SharePoint vulnerability (CVE-2026-50522, also a deserialization type) was added to the KEV, although it is not yet associated with ransomware campaigns as of today. Microsoft also flagged two other flaws (CVE-2026-55040 and CVE-2026-58644) patched on July 15 as attractive targets for attackers.

Context: The BlueHammer flaw (CVE-2026-33825)

In June 2026, CISA also confirmed the ransomware exploitation of the vulnerability CVE-2026-33825, nicknamed "BlueHammer," a privilege escalation flaw in Microsoft Defender (CVSS 7.8, CWE-1220). This vulnerability, which allowed access to the SAM database (Security Account Manager) containing password hashes of local accounts, was leaked in early April 2026 by a researcher known by the pseudonym "Nightmare Eclipse," along with proof-of-concept code. Again, Microsoft has not confirmed the exploitation in the wild despite the CISA alert.

CISA Recommendations

In its successive advisories, CISA outlined several mitigation and detection measures:

Patching:

  • Immediately apply the latest Microsoft patches and verify their successful installation
  • Shorten patch cycles

Detection and remediation:

  • Monitor affected servers for signs of exploitation
  • Enable Windows Antimalware Scan Interface (AMSI) integration for SharePoint web applications
  • Use Microsoft Defender Antivirus (MDAV) detections to identify and remediate compromises
  • Search for and remediate intrusion artifacts before running IIS machine keys
  • Establish appropriate logging to monitor abnormal activities

Hardening:

  • Avoid direct exposure of SharePoint servers to the Internet, unless necessary
  • Block external access to SharePoint Central Administration
  • Restrict communication between the farm and databases to required systems
  • Place servers behind a layer 7 reverse proxy or application-level security control when exposure is necessary
  • Refer to Microsoft’s official SharePoint Server hardening guide

The BOD 26-04 Framework

The urgency imposed by CISA relies on Binding Operational Directive 26-04, which requires federal agencies to prioritize patches based on four criteria: inclusion in the KEV catalog, the potential for large-scale automated exploitation, public asset exposure, and the level of control granted to the attacker upon success. Agencies unable to implement the mitigations must cease using the product.

This framework has enabled extremely short patch timelines — three days for CVE-2026-45659 — illustrating the importance CISA places on exposed SharePoint servers as an attack vector.

Constant vigilance necessary

With more than 200 SharePoint servers still unpatched against CVE-2026-45659 and exposed to the Internet, the opportunity window for ransomware groups remains open. CISA's confirmation that this flaw is now being used in ransomware campaigns underscores the urgency for organizations to verify the exposure of their SharePoint servers and apply patches without delay. The transition from "active exploitation" status to "ransomware exploitation" follows a well-established trajectory for SharePoint vulnerabilities, as evidenced by the 8 cases recorded since 2021.