PT-2026-42850 · Microsoft · Sharepoint Server

Meow · Published 2026-05-21 · Updated 2026-05-27 · CVE-2026-45659

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SharePoint Server Subscription Edition versions prior to 16.0.19725.20280 SharePoint Server 2019 versions prior to 16.0.10417.20128 SharePoint Enterprise Server 2016 versions prior to 16.0.5552.1002

Description Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker with Site Member permissions to execute arbitrary code remotely over a network. This issue can be exploited in low-complexity attacks without requiring elevated privileges. Real-world incidents have occurred where authenticated attackers used this flaw to execute remote code, escalate privileges, and perform lateral movement across SharePoint environments.

Recommendations Update SharePoint Server Subscription Edition to build number 16.0.19725.20280. Update SharePoint Server 2019 to build number 16.0.10417.20128. Update SharePoint Enterprise Server 2016 to build number 16.0.5552.1002.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-45659

Affected Products

Sharepoint Server

References · 37

• https://nvd.nist.gov/vuln/detail/CVE-2026-45659 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45659 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659 · Vendor Advisory
• https://twitter.com/CIDC_Ops/status/2059253100263944564 · Twitter Post
• https://twitter.com/TheHackersNews/status/2059241954987421923 · Twitter Post
• https://twitter.com/TheCyberSecHub/status/2059244553832644766 · Twitter Post
• https://twitter.com/molari999/status/2059244822666350934 · Twitter Post
• https://twitter.com/JNitterauer/status/2059309775267995735 · Twitter Post
• https://twitter.com/helpnetsecurity/status/2059226803584073976 · Twitter Post
• https://twitter.com/TheCyberSecHub/status/2059233175705170333 · Twitter Post
• https://twitter.com/TechNowPulse/status/2059364192608559128 · Twitter Post
• https://twitter.com/aviatrixtrc/status/2059311249196793862 · Twitter Post
• https://derp.ca/research/a-day-in-cybercrime-2026-05-26 · Reddit Post
• https://twitter.com/ALLITAustralia/status/2059344208805478884 · Twitter Post
• https://twitter.com/Leila97726926/status/2059323759215964443 · Twitter Post