--- title: CISA: Microsoft SharePoint flaw now exploited in... description: CISA has confirmed that ransomware gangs are actively exploiting CVE-2026-45659, a high-severity remote code execution vulnerability in Microsoft SharePoint... canonical: https://daily.dev/posts/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks-vx5dy86qs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CISA: Microsoft SharePoint flaw now exploited in ransomware attacks | daily.dev og:description: CISA has confirmed that ransomware gangs are actively exploiting CVE-2026-45659, a high-severity remote code execution vulnerability in Microsoft SharePoint... og:url: https://daily.dev/posts/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks-vx5dy86qs og:image: https://api.daily.dev/og/posts/vX5DY86qs.png og:image:alt: CISA: Microsoft SharePoint flaw now exploited in ransomware attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CISA: Microsoft SharePoint flaw now exploited in ransomware attacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary CISA has confirmed that ransomware gangs are actively exploiting CVE-2026-45659, a high-severity remote code execution vulnerability in Microsoft SharePoint caused by deserialization of untrusted data. The flaw allows low-privilege attackers to execute arbitrary code with low complexity. It was added to CISA's Known Exploited Vulnerabilities Catalog on July 1, with federal agencies ordered to patch within three days. Shadowserver tracks over 8,500 SharePoint servers exposed online, with more than 200 still unpatched. CISA recommends applying Microsoft's patches, enabling AMSI integration, and using Microsoft Defender Antivirus. This is the eighth SharePoint vulnerability CISA has flagged as exploited in ransomware attacks since November 2021. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is CVE-2026-45659 in Microsoft SharePoint being exploited by ransomware gangs? Yes, CISA confirmed ransomware gangs are now abusing CVE-2026-45659, a high-severity SharePoint deserialization remote code execution flaw affecting SharePoint Enterprise Server 2016, Server 2019, and Server Subscription Edition. The vulnerability was flagged as actively exploited since early July, added to CISA's KEV catalog on July 1, and updated in August to reflect ransomware abuse, though Microsoft has not yet confirmed exploitation in its own advisory. _Security teams tracking active ransomware exploits like this can follow ongoing coverage through daily.dev._ ### How many Microsoft SharePoint servers are still unpatched against CVE-2026-45659? Shadowserver tracks over 8,500 Microsoft SharePoint servers exposed online, with over 200 of them still unpatched against CVE-2026-45659 as of the reported scan. The flaw is a deserialization of untrusted data weakness allowing low-privileged attackers to achieve repeatable remote code execution with low complexity. _Admins patching exposed SharePoint deployments can track exploitation trends alongside daily.dev._ ## Similar posts on daily.dev - [CISA: Microsoft SharePoint RCE flaw now actively exploited](https://daily.dev/posts/cisa-microsoft-sharepoint-rce-flaw-now-actively-exploited-5qwo6lfyk) · BleepingComputer · 0 upvotes · 0 comments - [Unknown attackers exploit another critical SharePoint bug](https://daily.dev/posts/unknown-attackers-exploit-another-critical-sharepoint-bug-wlvkhutcz) · The Register · 0 upvotes · 0 comments - [Hackers leverage new Microsoft SharePoint exploit in attacks](https://daily.dev/posts/hackers-leverage-new-microsoft-sharepoint-exploit-in-attacks-poikstdjk) · BleepingComputer · 0 upvotes · 0 comments - [Rapid7 and Microsoft disclose CVE-2026-63520, a new SharePoint Remote Code Execution vulnerability](https://daily.dev/posts/rapid7-and-microsoft-disclose-cve-2026-63520-a-new-sharepoint-remote-code-execution-vulnerability-hfnwgfaon) · Rapid7 Cybersecurity Blog · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks-vx5dy86qs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CISA: Microsoft SharePoint flaw now exploited in ransomware attacks","url":"https://daily.dev/posts/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks-vx5dy86qs","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks-vx5dy86qs"},"datePublished":"2026-08-11T12:19:08.927Z","dateModified":"2026-09-13T20:20:49.574Z","description":"CISA has confirmed that ransomware gangs are actively exploiting CVE-2026-45659, a high-severity remote code execution vulnerability in Microsoft SharePoint...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d2c60599a8ee160870ff504e26aafddd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d2c60599a8ee160870ff504e26aafddd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks-vx5dy86qs","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ransomware","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"CISA: Microsoft SharePoint flaw now exploited in ransomware attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks-vx5dy86qs#faq","mainEntity":[{"@type":"Question","name":"Is CVE-2026-45659 in Microsoft SharePoint being exploited by ransomware gangs?","acceptedAnswer":{"@type":"Answer","text":"Yes, CISA confirmed ransomware gangs are now abusing CVE-2026-45659, a high-severity SharePoint deserialization remote code execution flaw affecting SharePoint Enterprise Server 2016, Server 2019, and Server Subscription Edition. The vulnerability was flagged as actively exploited since early July, added to CISA's KEV catalog on July 1, and updated in August to reflect ransomware abuse, though Microsoft has not yet confirmed exploitation in its own advisory. Security teams tracking active ransomware exploits like this can follow ongoing coverage through daily.dev."}},{"@type":"Question","name":"How many Microsoft SharePoint servers are still unpatched against CVE-2026-45659?","acceptedAnswer":{"@type":"Answer","text":"Shadowserver tracks over 8,500 Microsoft SharePoint servers exposed online, with over 200 of them still unpatched against CVE-2026-45659 as of the reported scan. The flaw is a deserialization of untrusted data weakness allowing low-privileged attackers to achieve repeatable remote code execution with low complexity. Admins patching exposed SharePoint deployments can track exploitation trends alongside daily.dev."}}]} ```