Critical SharePoint RCE Flaw Actively Exploited in Ransomware Campaigns

Ransomware actors are actively exploiting CVE-2026-45659, a critical remote code execution vulnerability in Microsoft SharePoint that requires only low-level privileges to weaponize against unpatched servers. The fact that this flaw has reached active ransomware exploitation underscores the dangerously narrow window organizations have between patch release and attacker action. CISA's three-day patching mandate for federal agencies reflects the severity, yet many organizations lack the processes to respond at that pace. This incident highlights how unpatched internet-facing collaboration platforms serve as high-value entry points for ransomware operators seeking network footholds.

Tactical Insight

Immediate Actions

Apply Microsoft's official patch for CVE-2026-45659 to all SharePoint servers within 72 hours or isolate unpatched instances from the internet immediately.
Add CVE-2026-45659 to your vulnerability scanning profiles and run an emergency scan across all SharePoint deployments now.

Long-Term Improvements

Establish a formal emergency patching SLA (≤72 hours) for CISA KEV-listed or CVSS 9.0+ vulnerabilities affecting internet-facing systems.
Maintain a continuously updated inventory of all internet-exposed assets, including version and patch status, to eliminate blind spots.
Enforce least-privilege access controls on SharePoint so that even low-privilege account compromise limits lateral movement potential.

Detection Measures

Deploy behavioral monitoring and SIEM rules to alert on anomalous code execution or unusual process spawning from SharePoint service accounts.
Integrate CISA's Known Exploited Vulnerabilities Catalog as an automated feed into your vulnerability management platform for real-time prioritization.