Deserialization of untrusted data in Microsoft Office SharePoint

CVE-2026-45659 is a deserialization bug in on-prem Microsoft SharePoint that lets an authenticated attacker send crafted data and turn ordinary SharePoint access into remote code execution on the server. Microsoft and NVD describe it as affecting SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition; NVD shows Subscription Edition fixed at 16.0.19725.20280, while Microsoft's May 2026 SharePoint security updates map to KB5002868 for 2016, KB5002870 for 2019, and KB5002863 for Subscription Edition.

Microsoft's HIGH 8.8 baseline is technically fair, but operational reality trims it down a bit. The decisive friction is authenticated access: this is not unauthenticated edge RCE, and many farms are internal or partner-limited, which means the bug is usually reached only after credential theft, VPN access, or some other initial foothold. That said, once an attacker has a low-priv SharePoint identity, the landing zone is a highly connected Windows server with ugly blast radius potential, so this is still a defender-priority HIGH, not routine backlog.

Why this verdict

• Downgrade for attacker position: PR:L is not cosmetic. The attacker needs a working SharePoint identity first, which compounds with phishing resistance, MFA, VPN, and SSO controls.
• Downgrade for reachable population: this hits on-prem SharePoint, not Microsoft 365 SharePoint Online. That sharply narrows affected population compared with Microsoft's broader cloud collaboration footprint.
• Hold at HIGH for blast radius: once code lands, it lands on a trusted Windows server that often holds sensitive content and internal connectivity. SharePoint server compromise is rarely a one-box problem.
• Downgrade for threat evidence: EPSS is low and there is no KEV listing or confirmed active exploitation in reviewed primary sources as of 2026-05-30.
• Partial re-upgrade for privilege floor: the required privilege is only low, not admin. In environments where any ordinary user can authenticate to the farm, the credential bar is annoyingly attainable.

Why not higher?

This is not unauthenticated pre-auth edge RCE, and that distinction matters. The need for authenticated access plus the smaller on-prem deployment base means the reachable victim set is much narrower than the CVSS impact terms suggest in the abstract. The lack of active exploitation evidence also removes the strongest argument for a CRITICAL call.

Why not lower?

Successful exploitation yields server-side code execution on an enterprise collaboration platform, not a sandboxed user-session bug. Even with the auth prerequisite, the target system is typically high-value, often externally reachable to some user population, and positioned close to sensitive data and internal trust paths. That is too much upside for attackers to call this MEDIUM.

1. Reduce exposure — Remove direct internet reachability for on-prem SharePoint where business permits, or gate it behind a reverse proxy/VPN with strong identity controls. For a HIGH verdict, deploy this compensating control within 30 days if you cannot patch immediately.
2. Enforce MFA on every external auth path — The exploit starts from authenticated access, so hardening the login path directly attacks the main prerequisite. Require phishing-resistant MFA where possible and close legacy or bypass auth paths within 30 days.
3. Shrink SharePoint user reach — Audit broad site-member assignments, stale partner accounts, service identities, and dormant users that can authenticate to the farm. Reduce that low-priv population within 30 days to make PR:L materially harder to satisfy.
4. Hunt for server-side execution from IIS — Alert on w3wp.exe or SharePoint service processes spawning powershell.exe, cmd.exe, cscript.exe, mshta.exe, or unsigned binaries. This does not prevent exploitation, but it gives you the best chance to catch successful abuse while remediation is being completed within 30 days.
5. Constrain service account blast radius — Review SharePoint application pool and service account privileges, local admin rights, secret storage, and lateral access paths. Tightening those controls within 30 days reduces what an attacker gets after code execution.

Run this on each SharePoint server in the farm from an elevated PowerShell session. Example: powershell.exe -ExecutionPolicy Bypass -File .\Test-CVE-2026-45659.ps1. Local administrator rights are recommended because the script reads HKLM and program file metadata. It reports VULNERABLE, PATCHED, or UNKNOWN based on installed SharePoint build and/or the presence of the May 2026 SharePoint security KBs.

# Test-CVE-2026-45659.ps1

# Detect patch state for CVE-2026-45659 on Microsoft SharePoint servers.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'

function Write-Result {
    param(
        [string]$State,
        [string]$Detail,
        [int]$Code
    )
    Write-Output ("{0} - {1}" -f $State, $Detail)
    exit $Code
}

function Get-InstalledKbMatch {
    param([string[]]$KbIds)

    $roots = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall'
    )

    foreach ($root in $roots) {
        Get-ChildItem $root | ForEach-Object {
            $p = Get-ItemProperty $_.PSPath
            foreach ($kb in $KbIds) {
                if (($p.DisplayName -match $kb) -or ($p.ReleaseType -match $kb) -or ($p.PSChildName -match $kb)) {
                    return $kb
                }
            }
        }
    }
    return $null
}

function Get-FileVersionSafe {
    param([string]$Path)
    if (Test-Path $Path) {
        try {
            return [version](Get-Item $Path).VersionInfo.FileVersion
        } catch {
            return $null
        }
    }
    return $null
}

# Fixed minimum builds from Microsoft/NVD review

$fixedSE    = [version]'16.0.19725.20280'
$fixed2019  = [version]'16.0.10417.20128'
$fixed2016  = [version]'16.0.5552.1002'

# Known KBs for May 2026 SharePoint security updates

$kbSE   = 'KB5002863'
$kb2019 = 'KB5002870'
$kb2016 = 'KB5002868'

# Quick path checks

$spRoot = Join-Path ${env:CommonProgramFiles} 'microsoft shared\Web Server Extensions\16'
$binDll = Join-Path $spRoot 'BIN\Microsoft.SharePoint.dll'

if (-not (Test-Path $spRoot)) {
    Write-Result 'UNKNOWN' 'SharePoint 16 hive not found on this host' 2
}

$fileVersion = Get-FileVersionSafe -Path $binDll
$kbHit = Get-InstalledKbMatch -KbIds @($kbSE, $kb2019, $kb2016)

# If the exact security KB is visible, trust that first.

if ($kbHit) {
    Write-Result 'PATCHED' ("Detected installed security update {0}" -f $kbHit) 0
}

# Heuristic edition detection

$isSubscription = $false
$subHints = @(
    'HKLM:\SOFTWARE\Microsoft\Office Server\Subscription',
    'HKLM:\SOFTWARE\Microsoft\Office Server\16.0\Subscription'
)
foreach ($hint in $subHints) {
    if (Test-Path $hint) { $isSubscription = $true }
}

# Read product version hints from registry if present

$regPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Office Server\16.0',
    'HKLM:\SOFTWARE\Microsoft\Office Server\16.0\SharePoint'
)
$productHint = $null
foreach ($rp in $regPaths) {
    $props = Get-ItemProperty $rp
    if ($props.ProductVersion) { $productHint = $props.ProductVersion }
    if ($props.Version) { $productHint = $props.Version }
}

if (-not $fileVersion) {
    Write-Result 'UNKNOWN' 'Unable to read Microsoft.SharePoint.dll version and no matching KB found' 2
}

# Subscription Edition is safest to identify by higher build train or explicit registry hint.

if ($isSubscription -or $fileVersion -ge [version]'16.0.15000.0') {
    if ($fileVersion -lt $fixedSE) {
        Write-Result 'VULNERABLE' ("Subscription Edition build {0} is below fixed {1}" -f $fileVersion, $fixedSE) 1
    } else {
        Write-Result 'PATCHED' ("Subscription Edition build {0} meets/exceeds fixed {1}" -f $fileVersion, $fixedSE) 0
    }
}

# Distinguish 2019 vs 2016 by build range.

# SharePoint 2019 uses a much higher 16.0.10xxx build train; 2016 uses 16.0.5xxx.

if ($fileVersion.Build -ge 10000) {
    if ($fileVersion -lt $fixed2019) {
        Write-Result 'VULNERABLE' ("SharePoint 2019 build {0} is below fixed {1}" -f $fileVersion, $fixed2019) 1
    } else {
        Write-Result 'PATCHED' ("SharePoint 2019 build {0} meets/exceeds fixed {1}" -f $fileVersion, $fixed2019) 0
    }
}
elseif ($fileVersion.Build -ge 5000) {
    if ($fileVersion -lt $fixed2016) {
        Write-Result 'VULNERABLE' ("SharePoint 2016 build {0} is below fixed {1}" -f $fileVersion, $fixed2016) 1
    } else {
        Write-Result 'PATCHED' ("SharePoint 2016 build {0} meets/exceeds fixed {1}" -f $fileVersion, $fixed2016) 0
    }
}
else {
    Write-Result 'UNKNOWN' ("Unrecognized SharePoint build train: {0}" -f $fileVersion) 2
}

Sources

1. NVD CVE-2026-45659
2. Microsoft Support: May 2026 Office updates
3. Microsoft Support: SharePoint Server 2019 KB5002870
4. Microsoft Support: SharePoint Server 2016 KB5002868
5. Microsoft Support: SharePoint Server Subscription Edition KB5002863
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS overview
8. Censys advisory on exposed on-prem SharePoint population during 2025 ToolShell