Microsoft SharePoint Server Deserialization of Untrusted Data Remote Code Execution

#!/usr/bin/env powershell
# Check-CVE202645659.ps1
# Verifies whether SharePoint Server is patched against CVE-2026-45659
# Run on each SharePoint server as local admin
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'

# Patched build numbers per version
$patchedBuilds = @{
    # SharePoint Server Subscription Edition
    '16.0.19725.20280' = 'Subscription Edition'
    # SharePoint Server 2019
    '16.0.10417.20128' = 'Server 2019'
    # SharePoint Enterprise Server 2016
    '16.0.5552.1002'   = 'Enterprise Server 2016'
}

# Version range identifiers
$versionRanges = @{
    'Subscription Edition'  = @{ MajorBuild = 19000; PatchedBuild = 19725; PatchedRevision = 20280 }
    'Server 2019'           = @{ MajorBuild = 10000; PatchedBuild = 10417; PatchedRevision = 20128 }
    'Enterprise Server 2016' = @{ MajorBuild = 4000;  PatchedBuild = 5552;  PatchedRevision = 1002  }
}

try {
    # Check if SharePoint is installed via registry
    $spKey = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0' -Name 'Location' -ErrorAction SilentlyContinue
    if (-not $spKey) {
        Write-Host '[UNKNOWN] SharePoint Server 16.x not detected on this host.'
        exit 2
    }

    # Get SharePoint build from installed products
    $farm = $null
    try {
        Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
        $farm = Get-SPFarm -ErrorAction SilentlyContinue
    } catch { }

    if ($farm) {
        $buildVersion = $farm.BuildVersion
        $build = $buildVersion.Build
        $revision = $buildVersion.Revision
        $fullVersion = "$($buildVersion.Major).$($buildVersion.Minor).$build.$revision"
        Write-Host "Detected SharePoint farm build: $fullVersion"
    } else {
        # Fallback: check file version of Microsoft.SharePoint.dll
        $spDll = Join-Path $spKey.Location 'ISAPI\Microsoft.SharePoint.dll'
        if (Test-Path $spDll) {
            $fileVer = (Get-Item $spDll).VersionInfo.FileVersion
            $parts = $fileVer.Split('.')
            $build = [int]$parts[2]
            $revision = [int]$parts[3]
            $fullVersion = $fileVer
            Write-Host "Detected SharePoint DLL version: $fullVersion"
        } else {
            Write-Host '[UNKNOWN] SharePoint installation detected but cannot determine build version.'
            exit 2
        }
    }

    # Determine which version range we're in and check patch status
    $identified = $false
    foreach ($ver in $versionRanges.GetEnumerator()) {
        $range = $ver.Value
        if ($build -ge $range.MajorBuild) {
            $identified = $true
            $versionName = $ver.Key
            if ($build -gt $range.PatchedBuild) {
                Write-Host "[PATCHED] SharePoint $versionName build $fullVersion is newer than patched build. CVE-2026-45659 is remediated."
                exit 0
            } elseif ($build -eq $range.PatchedBuild -and $revision -ge $range.PatchedRevision) {
                Write-Host "[PATCHED] SharePoint $versionName build $fullVersion meets or exceeds the patched version. CVE-2026-45659 is remediated."
                exit 0
            } else {
                Write-Host "[VULNERABLE] SharePoint $versionName build $fullVersion is BELOW the patched version. CVE-2026-45659 is NOT remediated."
                Write-Host "Required: build $($range.PatchedBuild) revision $($range.PatchedRevision) or later."
                Write-Host "Apply KB5002863 (SE), KB5002870 (2019), or KB5002868 (2016) immediately."
                exit 1
            }
        }
    }

    if (-not $identified) {
        Write-Host "[UNKNOWN] SharePoint build $fullVersion does not match known version ranges."
        exit 2
    }
} catch {
    Write-Host "[UNKNOWN] Error during check: $($_.Exception.Message)"
    exit 2
}