CVE-2026-45659: SharePoint RCE Flaw Lets Any Site Member Execute Code Remotely

A Site Member — not an admin, not a power user, just any authenticated member — can execute arbitrary code on your SharePoint Server. That is the reality of CVE-2026-45659, a deserialization remote code execution flaw Microsoft patched in its May 2026 Patch Tuesday release. With a CVSS score of 8.8, it is one of the most dangerous SharePoint vulnerabilities this year.

What Happened

On May 26, 2026, Microsoft released security updates addressing CVE-2026-45659, a remote code execution vulnerability affecting multiple versions of Microsoft SharePoint Server. The flaw stems from deserialization of untrusted data (CWE-502) — a class of vulnerability that has plagued enterprise applications for over a decade and continues to resurface in new forms.

According to InfoSec Bulletin, Microsoft's own advisory states: "Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network." The CVSS 3.1 base score of 8.8 places it firmly in high-severity territory.

As TheCyberThrone confirmed, and as also reported by Help Net Security, the attack requires only Site Member permissions (PR:L in CVSS terms) — the minimum privilege level for any user who can contribute content to a SharePoint site. No administrator, no site owner, no elevated role. If your organization grants Site Member access to employees, contractors, or partners, the attack surface is enormous.

Technical Analysis: Why This Is Dangerous

Deserialization vulnerabilities (CWE-502) are not new, but they remain among the most impactful because they turn a data-handling feature into a code execution primitive. Here is why CVE-2026-45659 is particularly concerning:

• Low privilege requirement. The attacker needs only Site Member access. In most enterprises, this is the default permission level for hundreds or thousands of users — including external collaborators and contractors who may not go through rigorous security vetting.
• Network attack vector. The exploit works over the network. No physical access, no social engineering, no phishing email required beyond the initial credential. An attacker who has compromised any Site Member account — through credential stuffing, password reuse, or a leaked token — can trigger the RCE directly.
• Deserialization of untrusted data. SharePoint accepts serialized data as part of its normal content management workflow. If an attacker can craft a malicious serialized payload and submit it through any feature that processes user-controlled data, the server will deserialize it — and execute embedded code in the process. This is the same vulnerability class that powered the Log4Shell (Log4j) catastrophe, albeit in a different context.
• SharePoint's deep integration. SharePoint Server typically runs with high-privilege service accounts and has access to the underlying Windows Server, Active Directory, SQL Server backend, and often Exchange. A successful RCE on SharePoint frequently becomes a pivot point for full domain compromise.

CVEfeed.io rates the vulnerability as high-severity with low attack complexity, meaning exploitation does not require unusual conditions or sophisticated tooling. Once a proof-of-concept becomes available — and for CVSS 8.8 SharePoint flaws, that typically happens within days of Patch Tuesday — mass scanning and exploitation follows quickly.

Impact

SharePoint is one of the most widely deployed enterprise collaboration platforms in the world. Key impact factors:

• Millions of servers run SharePoint Server globally, across government, healthcare, finance, education, and defense sectors
• Any authenticated user with Site Member permissions can exploit it — no admin required
• Full remote code execution on the server, typically under a high-privilege service account
• Deep network integration means SharePoint compromise often leads to lateral movement into Active Directory, SQL Server, and Exchange
• CVSS 8.8 — high severity with low attack complexity

While CISA has not yet added CVE-2026-45659 to its Known Exploited Vulnerabilities (KEV) catalog as of this writing, the combination of low privilege requirements, network attack vector, and high-severity impact makes rapid exploitation likely. Organizations should treat this as an urgent patching priority.

How to Protect Yourself

1. Apply the May 2026 Patch Tuesday updates immediately. Microsoft has released patches for all supported SharePoint Server versions. If you run SharePoint Server 2016, 2019, or Subscription Edition, verify the patch is applied. This is the single most effective mitigation.
2. Audit Site Member permissions. Review who has Site Member access across your SharePoint sites. Remove access for users and service accounts that do not need it. Pay special attention to external guest accounts and contractor access.
3. Restrict or disable custom deserialization routines. As OpenCVE recommends, limit uploads of untrusted data to authorized workflows only. If your organization uses custom web parts or third-party SharePoint extensions that process serialized data, audit them for unsafe deserialization patterns.
4. Monitor SharePoint logs aggressively. Watch for abnormal deserialization activity, unexpected code execution events, or unusual outbound network connections from SharePoint server processes. Enable Windows Event Logging and forward logs to your SIEM.
5. Enforce MFA for all SharePoint access. Since the vulnerability requires authenticated access, strong multi-factor authentication raises the bar for attackers attempting to use compromised credentials.
6. Segment SharePoint servers. Ensure SharePoint Server instances are network-segmented from critical infrastructure. If an RCE occurs, proper segmentation limits lateral movement into Active Directory, SQL Server, and other high-value targets.

The Bigger Picture

CVE-2026-45659 is a reminder that deserialization vulnerabilities — a class many considered "well-understood" — continue to surface in major enterprise platforms. It follows a pattern: a widely deployed product accepts serialized data, a researcher finds an unsafe deserialization path, and suddenly millions of servers are one crafted payload away from full compromise.

Microsoft's Patch Tuesday this month also addressed other high-severity flaws, but CVE-2026-45659 stands out because of the low privilege bar and the sheer number of organizations running unpatched SharePoint instances. If you have not patched yet, assume the clock is ticking.