Microsoft SharePoint CVE-2026-45659

Exploitation requires the attacker to hold a valid SharePoint account with at least low-privilege access (CVSS PR:L) to an affected SharePoint Enterprise Server 2016, Server 2019, or Subscription Edition farm - anonymous access is not sufficient based on the CVSS vector. The vulnerable deserialization sink must be reachable over the network (AV:N) on the SharePoint web front-end, and no user interaction is required (UI:N). Limiting factors include the authentication requirement (excluding purely external unauthenticated attackers), the fact that SharePoint Online is not in the affected CPE list, and that organizations enforcing least-privilege site permissions and network segmentation in front of SharePoint will reduce the pool of accounts that can reach the vulnerable endpoint.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a network-reachable, low-complexity flaw requiring only low-privilege authentication and yielding full confidentiality, integrity, and availability impact - a profile that maps well to typical SharePoint user accounts which are commonly distributed across an enterprise. Temporal metrics (E:U/RL:O/RC:C) show exploit code maturity is Unproven, an official fix is available, and the report is confirmed, lowering the effective temporal score. There is no public exploit identified at time of analysis, no CISA KEV listing in the provided data, and no EPSS score supplied, so quantitative exploitation probability cannot be stated; however, SharePoint deserialization bugs have a strong historical track record of being weaponized shortly after patch release once researchers diff the update, so the practical risk for internet-exposed or broadly-accessible internal SharePoint farms should be treated as high despite the current 'Unproven' rating.

An attacker obtains low-privilege SharePoint credentials through phishing, credential stuffing, or an insider account and authenticates to the SharePoint web front-end. They then submit a crafted HTTP request to a SharePoint endpoint that deserializes user-supplied data, embedding a .NET gadget chain payload that triggers arbitrary command execution under the SharePoint application pool identity, leading to full farm compromise; no public exploit identified at time of analysis, but the low attack complexity and known SharePoint deserialization gadget research make weaponization feasible after patch diffing.