SharePoint flaw CVE-2026-45659 lands on CISA’s must-patch list

In brief: CISA has added SharePoint CVE-2026-45659, a remote-code-execution flaw in Microsoft SharePoint Server, to its Known Exploited Vulnerabilities catalogue after confirmed exploitation. Federal civilian agencies were ordered to patch by 4 July. The Hacker News reports Microsoft omitted the flaw from its May 2026 Patch Tuesday notes and updated the advisory on 27 May.

A remote-code-execution vulnerability in Microsoft SharePoint Server, tracked as CVE-2026-45659, has been added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalog after confirmed exploitation in the wild. Federal civilian agencies were ordered to patch by July 4.

Inclusion in the KEV catalog is CISA’s signal that a flaw is not theoretical but actively being used by attackers. SharePoint is widely deployed for internal document management and collaboration, making a server-side code-execution bug especially serious for organizations that host it on-premises.

According to reporting by The Hacker News, Microsoft had inadvertently omitted CVE-2026-45659 from its initial May 2026 Patch Tuesday release notes and only updated the advisory on May 27 — a gap that can leave defenders unaware a fix exists.

Administrators running SharePoint Server should apply Microsoft’s update immediately and review servers for signs of compromise, following CISA’s guidance regardless of whether they fall under the federal deadline.

Read more: SharePoint flaw CVE-2026-45659 lands on CISA’s must-patch list · Proof-of-concept exploit released for Android ‘SMS of Death’ flaw · WordPress Core flaw draws nearly 63,000 attack attempts in 24 hours

Sources: CISA Known Exploited Vulnerabilities Catalog; reported by The Hacker News.

Fact-checked against the linked sources before publication. Spotted an error? See our Corrections Policy.

Spotted an error? Email corrections@itmagazineme.com with the article link.