The U.S. Cybersecurity and Infrastructure Security Agency (Cybersecurity and Infrastructure Security Agency) has added a critical Microsoft SharePoint vulnerability to its Known Exploited Vulnerabilities (KEV) catalog — a strong signal that the flaw is no longer theoretical, but actively being exploited in real-world environments.
For defenders, this changes everything.
When a vulnerability enters KEV, it immediately shifts from a backlog item to an active threat priority.
The Vulnerability
The flaw tracked as CVE-2026-45659 is a remote code execution (RCE) vulnerability affecting on-premises Microsoft SharePoint deployments.
The issue originates from insecure deserialization of untrusted data, allowing authenticated attackers to execute arbitrary code on vulnerable servers.
What makes this particularly concerning:
- Requires only valid authentication
- No elevated privileges needed
- Can be exploited by low-privileged users
- Opens the door to full server compromise
This places collaboration infrastructure directly in the blast radius.
Affected Platforms
The impacted SharePoint versions include:
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server 2016
While patches were released earlier, KEV inclusion confirms threat actors are now actively targeting unpatched systems.
That means delay equals exposure.
Why This Matters
SharePoint is not just another enterprise application.
It often holds:
- Sensitive documents
- Internal workflows
- Business intelligence
- Identity integrations
- Collaboration data
A compromise here is rarely isolated.
It can become:
- A foothold for lateral movement
- A data exfiltration point
- A persistence mechanism
- A privilege escalation pathway
This is exactly why attackers love collaboration platforms.
They sit at the center of trust.
The Bigger Lesson
This KEV addition reinforces a hard truth:
Patch management based only on monthly cycles is no longer enough.
Threat-informed vulnerability management is now mandatory.
If your patching model treats a KEV-listed vulnerability the same as any other medium-risk CVE, your prioritization model is broken.
Security teams must move from:
CVSS-based prioritization
to
Threat intelligence + exploitability + exposure-based prioritization
Because KEV is exploitation intelligence.
Not prediction.
Proof.
Immediate Actions
If you operate SharePoint:
1. Identify all exposed instances
Map internal and internet-facing deployments.
2. Patch immediately
Do not wait for the next maintenance window.
3. Review authentication logs
Look for abnormal access patterns.
4. Hunt for persistence
Inspect for:
- Web shells
- Scheduled tasks
- Suspicious service creation
- Unexpected PowerShell activity
5. Reduce privilege sprawl
Validate SharePoint access rights and remove excessive permissions.
Final Thoughts
Every KEV entry tells a story.
The story here is simple:
Attackers are exploiting SharePoint right now.
And if your organization still treats patching as a calendar event instead of a threat response function, this is the moment to rethink it.
Because in cybersecurity, the difference between secure and compromised is often measured in days.
Sometimes hours.
