The US cybersecurity agency CISA has added a vulnerability in Microsoft SharePoint Server to its list of known, actively exploited vulnerabilities (KEV). The vulnerability, CVE-2026-45659, has a CVSS rating of 8.8 out of 10 and allows a logged-in attacker to remotely execute code on the server.

What is the error?

The problem lies in how SharePoint handles deserialization of untrusted data. An attacker only needs regular member privileges on a website — no administrator rights are required — to trigger the vulnerability and run their own code on the server. Microsoft patched the bugalready in May 2026for SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Enterprise Server 2016.

Microsoft said "unlikely" – then it happened

What makes the case extra interesting is that Microsoft themselves rated the likelihood of active exploitation as "less likely" when the patch was released. A few weeks later, CISA confirmed that the vulnerability is actually being exploited in real life. It is not yet clear exactly which actors are behind it or what the end goal is, but federal authorities in the United States were given a deadline of July 4, 2026 to patch.

Why it matters for Swedish companies

SharePoint is also widely used outside the United States — by agencies, government agencies and medium-sized businesses that operate internal collaboration spaces and document management. An untreated server exposed to the Internet can give an attacker full code execution, which in the worst case scenario opens the door to everything from data theft to ransomware.

This is how you protect yourself

  • Check which version of SharePoint Server you are running and install Microsoft's May 2026 security update immediately if you have not already done so.

  • Review which SharePoint instances are exposed to the Internet — restrict access where possible.

  • Review logs for unusual activity from account members with only basic access.

  • If you use cloud-based SharePoint (Microsoft 365) you are not affected by this particular vulnerability, but it is a good time to double-check general patch routines for local servers.

The incident is another example of a pattern we've seen repeatedly in 2026: vulnerabilities that vendors deem low-risk quickly turn out to be tools of choice for attackers, often within days to weeks of a patch being made public.