CVE-2026-45659 — what the primary record says, and why the number everyone is quoting is wrong.
Published: 12 August 2026 · Last reviewed: 12 August 2026 · Status: vendor and agency assessments in disagreement; expect revisions
Does this apply to you?
Yes, if you run on-premises SharePoint: Enterprise Server 2016, Server 2019, or Subscription Edition, below these builds:
| Product | Fixed build |
|---|---|
| SharePoint Enterprise Server 2016 | 16.0.5552.1002 |
| SharePoint Server 2019 | 16.0.10417.20128 |
| SharePoint Server Subscription Edition | 16.0.19725.20280 |
Check the installed build against that table. Not the patch ticket — the build.
No, if you use SharePoint Online in Microsoft 365. This affects on-premises server products only.
Yes, even if your SharePoint isn’t internet-facing. This is the part the coverage buries, and it’s the whole point of this post.
If you patched in the May 2026 cycle, you were never exposed to this. Nothing that happened yesterday changes your position.
What actually changed on 11 August
Almost nothing, and it’s worth being precise about that before anyone reaches for the incident channel.
CISA added CVE-2026-45659 to the Known Exploited Vulnerabilities catalogue on 1 July 2026, with a remediation deadline of 4 July for federal civilian agencies. That was the moment the risk changed. On 11 August, CISA updated one metadata field in that existing entry — the “Known To Be Used in Ransomware Campaigns” flag, which had read Unknown as recently as early July, now reads Known.
So the news is a field flip on a six-week-old KEV entry, not a new campaign, not a new exploit, and not a new deadline. That matters because “now exploited in ransomware attacks” reads like something started yesterday. What started yesterday is CISA’s willingness to assert a ransomware association it previously wouldn’t.
If you’re already patched, this is an intelligence update. If you’re not, you are six weeks past a federal deadline, and the ransomware flag is the least of your problems.
What the primary record says
From the CVE record, with Microsoft as the assigning authority: this is a deserialization of untrusted data weakness (CWE-502) in Microsoft Office SharePoint that allows an authorized attacker to execute code over a network.
Read that adjective. Authorized.
The CVSS 3.1 vector, also assigned by Microsoft, is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — base score 8.8, High. NVD has not published its own independent assessment, so the 8.8 you see everywhere is the vendor’s number, not a second opinion.
Two components of that vector do all the work:
PR:L — Privileges Required: Low. An attacker needs to authenticate to SharePoint first. Microsoft’s guidance indicates the floor is Site Member permissions, with no administrative or elevated rights needed. That is an ordinary employee-level account.
AC:L — Attack Complexity: Low. Once authenticated, exploitation is reliable and repeatable.
And from CISA’s own SSVC decision data attached to the record: exploitation active, technical impact total, automatable no.
Sit with that last one. CISA — the agency asserting active exploitation, the agency that just added the ransomware flag — assesses this as not automatable. It is not a mass-scannable, wormable, spray-the-internet vulnerability. It requires a credential, per target, first.
Why the number everyone will quote is the wrong one
The figure circulating in coverage is from Shadowserver: roughly 8,500 SharePoint servers exposed online, of which over 200 are unpatched against this CVE.
Two hundred sounds manageable. It is also close to meaningless as a measure of your risk, in a direction most people get backwards.
External scanning can only see servers reachable from the internet. But this vulnerability needs an authenticated session, not internet reachability. Which means the population of genuinely at-risk servers is every unpatched on-premises SharePoint instance that any user can authenticate to — including the internal-only farm behind the VPN that no scanner will ever fingerprint, and which is very often the one that never gets patched precisely because someone decided it wasn’t exposed.
That 200 is a floor, and it is measuring the wrong population. If your exposure assessment for this CVE consisted of confirming your SharePoint isn’t internet-facing, you have not assessed it.
The real question is: who can authenticate to your SharePoint servers, and are those servers patched? This reframes an 8.8 RCE as something closer to an identity-hygiene problem. An organisation with tight account lifecycle management, no dormant accounts and scoped contractor access carries materially less risk from this CVE than an organisation with four thousand stale accounts and a decade of accumulated guest access — at an identical CVSS score, identical patch level, identical network position.
CVSS cannot see your identity estate. This is precisely the point at which a technical severity rating stops being sufficient, and a risk judgment has to take over. You cannot triage this one from the vulnerability scanner alone.
Where the sources disagree
This is unresolved, and anyone presenting it as settled is overreaching in one direction or the other.
CISA asserts active exploitation (since 1 July) and, as of 11 August, ransomware association.
Microsoft rated exploitation as Exploitation Less Likely when it shipped the fix in May, and as of this writing has still not updated its advisory to mark the vulnerability as exploited in the wild.
Those positions cannot both be current and correct. I don’t know which is right, and I’m not going to guess. What I’d note is that the vendor exploitability label has now been contradicted by observed reality within about six weeks — which is a useful data point about how much weight that label should carry in a deferral decision.
What nobody has established
Attribution. As of Tenable’s mid-July analysis, neither CISA nor Microsoft had attributed exploitation of this CVE to any named actor. I have found nothing since that changes this.
You will nonetheless see this CVE linked to Storm-2603 and Warlock ransomware. Trace that back, and it collapses. The Storm-2603 material comes from a separate Microsoft ransomware investigation reported in late June, in which — per Microsoft — initial access was likely attempted through a different vulnerability, with probing for files like win.ini and web.config suggesting local file inclusion. Storm-2603 has a documented history against on-premises SharePoint going back to mid-2025. That history is real. Its connection to CVE-2026-45659 specifically is an inference that at least one write-up has promoted into a headline.
Exploit mechanics. No public proof-of-concept was available as of mid-July. The specific vulnerable component, the gadget chain, and reliable in-the-wild indicators are not in the public record. If a write-up offers you detection logic specific to this CVE, ask where it came from.
Beware the confident aggregators. At least one advisory site describes this as a critical vulnerability used for initial access by ransomware groups, citing Reddit among its sources. It is rated High, not Critical, and it cannot be used for initial access because it requires an authenticated session. Both errors point the same way: toward more alarm and less accuracy. That pattern — inflated severity, inverted preconditions, cited social media — is now common enough in AI-assembled advisory content that it’s worth treating as a smell.
What to actually do
1. Inventory, then verify builds. Find every on-premises SharePoint instance, including internal-only farms and anything an MSP manages on your behalf. Compare installed builds against the table at the top. A closed patch ticket is not evidence.
2. Patch, if you somehow haven’t. The fix has been available since May.
3. Assume patching does not evict. If a server was unpatched during the exploitation window, the patch removes the flaw but proves nothing about whether it was reached. The 2025 ToolShell incidents established the relevant precedent: attackers targeting on-premises SharePoint stole ASP.NET machine keys to maintain access that survived patching. I have not seen that behaviour confirmed for this CVE — treat it as precedent, not as a finding — but the cost of rotating machine keys on a formerly unpatched server is low, and the cost of being wrong is not.
4. Hunt backwards, not forwards. Your exposure window ran from May, or earlier, through whenever you actually patched. Review SharePoint logs across that window, not from today.
5. Review who can authenticate. Enumerate accounts with Site Member or better on every SharePoint farm. Dormant accounts, ex-contractors, service accounts with interactive rights. This is the control that actually bounds this vulnerability’s severity in your environment.
6. Enable AMSI integration for SharePoint web applications and ensure Defender Antivirus detections are active, per CISA’s guidance.
7. Then fix the process defect. Somebody may have deferred the May SharePoint patch. If the reason was the vendor’s Exploitation Less Likely rating, that input has now demonstrated a six-week failure mode. That is a finding about your prioritisation pipeline, and it will recur on a different CVE if you only close the ticket.
Confidence summary
Confirmed by primary source (CVE record / NVD, Microsoft as CNA): CWE-502; the authorised-attacker description; CVSS 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; the three affected products and exact fixed builds; CVE published 22 May 2026; KEV added 1 July 2026 with 4 July due date; CISA SSVC values including automatable no.
Confirmed by reporting, consistent across multiple outlets: the Site Member permission floor; the May patch release; Microsoft’s Exploitation Less Likely rating; the 11 August ransomware-flag update; Microsoft’s advisory not yet marked as exploited.
Single-source, not independently verified here: the Shadowserver counts (~8,500 exposed, 200+ unpatched) come from dashboard queries cited in one article; I have not run the queries myself. Treat as indicative.
Counts that vary by date: SharePoint entries in KEV were reported as 12 total, with 7 ransomware-associated, in mid-July, and 14, with 8, in mid-August. Both may be accurate for their respective dates. Cite with an as-of date.
Not established by anyone: actor attribution for this CVE; exploit mechanics; the specific vulnerable component; reliable CVE-specific indicators of compromise.
Disambiguation. Several distinct on-premises SharePoint CVEs are in circulation for 2026, including CVE-2026-32201, CVE-2026-56164 and CVE-2026-58644. This post covers CVE-2026-45659 only. It is also not the 2025 ToolShell chain. Check the identifier before acting on any advice, including this.
Sources
- CVE-2026-45659 record, NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-45659
- Microsoft Security Response Centre advisory — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659
- CISA Known Exploited Vulnerabilities Catalogue — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- CISA BOD 26-04, Prioritising Security Updates Based on Risk (referenced in the KEV required action)
- Tenable, SharePoint CVEs FAQ, 16 July 2026 — https://www.tenable.com/blog/cve-2026-32201-cve-2026-45659-cve-2026-56164-faq-sharepoint-server-exploitation
- SOCRadar, on the KEV entry’s original Unknown ransomware status — https://socradar.io/blog/cisa-sharepoint-rce-cve-2026-45659/
- SecurityWeek, 2 July 2026 — https://www.securityweek.com/cisa-warns-of-actively-exploited-microsoft-sharepoint-vulnerability/
- BleepingComputer, 11 August 2026 (source of the Shadowserver figures) — https://www.bleepingcomputer.com/news/security/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks/
- Shadowserver dashboard, exposed SharePoint servers — https://dashboard.shadowserver.org/
Corrections to this post will be appended below, dated, with the original text left visible. Microsoft’s advisory status and CISA’s assessment are currently in disagreement; this page will be revised when either changes.
Leave a Reply