SharePoint RCE Vulnerability Lands on CISA's Exploited List — Companies Scramble

July 9, 2026 — Rachel Kim 5 min read

A critical Microsoft SharePoint remote code execution flaw has been catalogued by U.S. cybersecurity authorities after investigators confirmed threat actors were actively leveraging it against real-world targets. The vulnerability, tracked as CVE-2026-45659, landed on the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog on Wednesday, triggering mandatory remediation timelines for federal agencies and urgent advisories for private sector operators.

CISA Flags SharePoint Flaw as Actively Exploited

The agency added CVE-2026-45659 to its catalog on Wednesday, citing evidence of active exploitation in the wild. Under a binding operational directive issued in 2021, federal civilian executive branch agencies now face a three-week deadline to apply patches or mitigations. CISA did not disclose specific victim organisations or the identity of the threat groups deploying the exploit.

The vulnerability carries a CVSS severity score of 9.8 out of 10, placing it in the critical range. Security researchers described it as a pre-authentication flaw, meaning attackers can execute arbitrary code on vulnerable servers without needing valid credentials or any user interaction. That combination makes it particularly dangerous for internet-facing SharePoint deployments.

Technical Breakdown: How the Flaw Works

Microsoft's security documentation confirms the vulnerability exists within the SharePoint Enterprise Server data layer. Attackers who exploit it can gain full control over the affected server, potentially reading sensitive documents, harvesting authentication tokens, or pivoting deeper into an organisation's network. The flaw affects SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.

Security firm CrowdStrike published technical analysis noting that exploitation requires no specially crafted requests that might trigger traditional intrusion detection systems. "An attacker needs only to send a malformed query to a vulnerable endpoint," the firm stated in a blog post. "There is no user interaction required and no authentication needed. This is about as severe as it gets for a server-side vulnerability."

Economic Fallout: Immediate Costs Hit Enterprise IT Budgets

The disclosure sent ripples through enterprise IT spending projections. Organisations running unpatched SharePoint deployments now face a stark choice: accelerate emergency patching cycles or risk regulatory scrutiny and potential breach liability. Industry analysts estimated that emergency SharePoint patching projects typically cost between $50,000 and $500,000 for mid-sized enterprises, depending on infrastructure complexity.

For larger organisations with sprawling SharePoint farms, the mathematics become uncomfortable. A typical Fortune 500 company might operate hundreds of SharePoint servers across multiple data centres. Patching each server requires maintenance windows, testing cycles, and rollback protocols. The window CISA has given federal agencies — 21 days — may stretch into weeks or months for private sector entities with less aggressive patch management cultures.

Insurance and Compliance Implications

Cyber insurance providers are expected to sharpen their scrutiny of policy applicants following this disclosure. Insurers already charge 30 to 40 percent more for policies covering organisations with known unpatched vulnerabilities at the time of application. Some carriers are expected to add specific SharePoint vulnerability attestations to their underwriting questionnaires. Organisations that cannot demonstrate rapid remediation capabilities may face higher deductibles or coverage exclusions.

The regulatory exposure extends beyond insurance. Organisations subject to SEC disclosure rules must evaluate whether the vulnerability represents a material cybersecurity risk requiring public disclosure. Healthcare entities governed by HIPAA and financial services firms under Gramm-Leach-Bliley Act requirements face similar obligations. The combination of active exploitation and a three-week federal deadline creates a documented timeline that plaintiffs' attorneys will scrutinise in future breach litigation.

Market Reaction: Cybersecurity Stocks Surge

Financial markets registered the news within hours of the CISA announcement. Shares of endpoint security vendors rose broadly on Thursday, with CrowdStrike gaining 4.2 percent and SentinelOne adding 3.7 percent in early trading. Analysts at Morgan Stanley noted that emergency vulnerability disclosures historically drive short-term demand for incident response retainers and security posture assessments.

Microsoft shares dipped 1.1 percent following the disclosure before recovering most losses by market close. The company's Azure cloud platform, which hosts many SharePoint Online workloads, was not affected by the vulnerability. The on-premises products face the brunt of the exposure. Microsoft has not disclosed the number of affected customer deployments.

Supply Chain Risks Spread Beyond Initial Targets

Security researchers warned that SharePoint servers often serve as integration points for third-party business applications. Document management systems, customer relationship platforms, and financial reporting tools frequently pull data directly from SharePoint repositories. An attacker who compromises a SharePoint server may gain access to credentials that unlock these connected systems.

"SharePoint is rarely standalone," said a senior security architect at a global financial services firm who requested anonymity to discuss internal infrastructure. "Every SharePoint compromise we model could theoretically cascade into dozens of connected applications. That amplification effect is what makes this economically significant beyond the initial server."

Microsoft's Response and Remediation Path

The Redmond, Washington-based technology company confirmed it is actively developing security updates for all affected SharePoint versions. As of the disclosure date, no fully patched version was available, though Microsoft released guidance on workarounds that organisations can implement while awaiting official patches.

Microsoft recommended organisations restrict external access to SharePoint servers where possible and monitor for anomalous activity patterns indicative of exploitation attempts. The company also urged customers to enable enhanced logging to aid forensic investigations should a breach occur.

What Organisations Should Do Right Now

Security professionals recommended immediate inventory checks to identify vulnerable SharePoint deployments. Many organisations have lost track of shadow SharePoint instances deployed by individual business units without central IT knowledge. Asset discovery tools can surface these forgotten installations before attackers do.

For organisations running unsupported SharePoint versions — a category that includes SharePoint Server 2013, which exited Microsoft's support lifecycle — there is no official patch coming. These entities face a forced upgrade decision on an accelerated timeline. Microsoft offers migration tools for moving legacy SharePoint content to Microsoft 365's cloud-based SharePoint Online, though the process can take months for large document repositories.

Looking Ahead: The Next Two Weeks Are Critical

The 21-day federal deadline expires in early February. Security teams should expect Microsoft's official patches to arrive before that cutoff, but there is no guarantee. If patches are delayed, agencies will need to document compensating controls — network segmentation, web application firewalls, enhanced monitoring — and submit justification to CISA.

Watch for two developments in the coming days. First, expect additional threat intelligence from Microsoft and its partners detailing the specific attacker groups exploiting the flaw. Attribution details will help organisations assess their exposure based on industry and profile. Second, watch for the emergence of public proof-of-concept exploit code. When such code appears — and security researchers expect it within days — the pool of potential threat actors expands dramatically beyond the sophisticated groups currently exploiting the vulnerability.