A SharePoint Server bug that Microsoft patched in May is now being exploited in the wild, and on July 1 the U.S. Cybersecurity and Infrastructure Security Agency added it to the Known Exploited Vulnerabilities catalog — which is a bureaucratic way of saying: the fix has existed for two months, and attackers found the servers that never installed it.

According to The Hacker News, the flaw is tracked as CVE-2026-45659, carries a CVSS score of 8.8, and is a remote code execution issue stemming from the deserialization of untrusted data. Microsoft addressed it in May 2026 across SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. CISA cited evidence of active exploitation when it added the bug to the KEV catalog and, under the usual timeline, directed Federal Civilian Executive Branch agencies to apply the fixes by July 4, 2026.

What the vulnerability actually does

Deserialization bugs are a well-worn class of vulnerability: when an application rebuilds an object from attacker-controlled data without validating it, that data can be coaxed into executing code. In this case, CISA states the flaw “allows an authorized attacker to execute code over a network.” Per Microsoft, any authenticated attacker can trigger it — no admin rights required — and a network-based attacker with as little as Site Member permissions could run code remotely on the server.

Here is the part that aged like milk: Microsoft’s own advisory reportedly tagged the bug with an “Exploitation Less Likely” assessment. Reader, it was exploited. Threat intelligence hasn’t publicly pinned down exactly how the vulnerability is being abused, who is behind it, or what the end goal is — so we’ll hedge accordingly — but the KEV listing means someone, somewhere, is already using it.

SharePoint has been a hunting ground for a while

On-premises SharePoint has been a favorite target for months. Late last month, Microsoft revealed that a routine ransomware investigation uncovered two unrelated attackers operating inside the same network at once. One cluster was attributed to Storm-2603, an actor known for deploying Warlock ransomware, frequently by exploiting known flaws in on-premises SharePoint servers since mid-2025. Microsoft says the group leaned on legitimate tooling — the Velociraptor DFIR tool, Cloudflare tunneling, Zoho Assist, and SSH configured through Visual Studio Code — to blend in, created rogue local and domain admin accounts, and used a vulnerable driver to tamper with endpoint defenses. A second, separate actor coexisted in the same environment using DLL side-loading and custom backdoors, which made attribution messier.

The lesson Microsoft drew is worth keeping: what looks like a single ransomware incident can turn out to span multiple organizations and multiple actors at once. Isolated signals rarely tell the whole story.

What to do about it

• Patch now: Apply Microsoft’s May 2026 SharePoint Server updates for Subscription Edition, 2019, and 2016 if you somehow haven’t.
• Treat KEV as a deadline, not a suggestion: The federal July 4 date isn’t a legal obligation for private orgs, but it’s a fine benchmark for “yesterday.”
• Assume low privilege is enough: Because Site Member permissions suffice, audit SharePoint account permissions and hunt for admin accounts nobody remembers creating.
• Hunt for the persistence tradecraft: Look for abuse of Velociraptor, unexpected Cloudflare tunnels or Zoho Assist sessions, SSH stood up via VS Code, and suspicious driver loads tied to endpoint-defense tampering.
• Get on-prem SharePoint off the open internet: If it must be exposed, wrap it in monitoring and access controls and watch it like it’s already compromised.

The outrage

We’d love to say we’re surprised. We are not. The patch shipped in May. The exploitation showed up anyway, because a meaningful number of internet-facing SharePoint servers apparently still haven’t taken it. “Exploitation Less Likely” is not a force field; it’s a probability estimate, and attackers are extremely willing to disprove your estimates. Every KEV entry for an already-patched bug is, quietly, a report card on patch management — and this one is not going on the fridge.

Expect more of this. On-premises collaboration servers are sticky, hard to retire, and stuffed with exactly the kind of internal documents that make ransomware crews salivate. Until patching cadence catches up with disclosure cadence, the KEV catalog will keep functioning as a running list of fixes that were sitting right there. Patch your SharePoint. We’ll be back here again soon enough.