Microsoft Said Exploitation Was 'Less Likely' ... but CISA Just Added SharePoint RCE to KEV List

Microsoft said exploitation was 'less likely' ... but CISA just added SharePoint RCE to KEV list

Microsoft's prediction that attackers probably wouldn't rush to exploit a newly-patched SharePoint bug hasn't aged especially well. CISA has added CVE-2026-45659, a remote code execution flaw in on-premises Microsoft SharePoint Server, to its Known Exploited Vulnerabilities (KEV) catalog after confirming that crimes are now actively exploiting it in the wild. The bug stems from an insecure deserialization issue and affects SharePoint Server Subs…

CISA: Microsoft SharePoint RCE flaw now actively exploited

CISA warned on Wednesday that attackers have begun exploiting a high-severity Microsoft SharePoint remote code execution vulnerability patched in May.

CVE-2026-45659: The SharePoint RCE Now on CISA's KEV List

CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalog on July 2, 2026, confirming active exploitation of a remote code execution vulnerability in Microsoft SharePoint that was patched six weeks ago. The patch existed. The exploitation is happening anyway. If you are running on-premises SharePoint and have not applied the May 2026 update, here is […] The post CVE-2026-45659: 4 Things to Know About the SharePoint RCE on CISA KEV…

CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability

CISA says threat actors are exploiting a recently patched SharePoint remote code execution vulnerability (CVE-2026-45659). The post CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability appeared first on SecurityWeek.

SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation

Vulnerability / Threat IntelligenceThe U.S. Cybersecurity and Infrastructure Security Agency (CISA