PT-2026-42850 · Microsoft · Sharepoint Server
Meow
·
Published
2026-05-21
·
Updated
2026-07-13
·
CVE-2026-45659
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
SharePoint Enterprise Server 2016
SharePoint Server 2019
SharePoint Server Subscription Edition
Description
An issue exists in the deserialization mechanism of untrusted data, which allows an authenticated attacker to execute arbitrary code remotely over a network. An attacker requires only Site Member permissions, meaning no elevated privileges or user interaction are necessary. The flaw is remotely exploitable from the internet and has been confirmed as actively exploited in the wild, including by ransomware actors. This issue can lead to full system compromise, data exfiltration, and serve as a pivot point for further network penetration.
Recommendations
Apply the security updates released by Microsoft on May 21, 2026, for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.
Audit Site Member permissions to minimize the risk of exploitation by low-privilege accounts.
Fix
DoS
RCE
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sharepoint Server