Ransomware gangs exploit SharePoint vulnerabilities: 200 unpatched servers exposed

CISA Confirms: Ransomware Gangs Exploit Critical Vulnerability in Microsoft SharePoint

The CISA has confirmed today that criminal groups are actively exploiting a remote code execution vulnerability in Microsoft SharePoint, classified as critical and actively exploited since early July. The flaw, identified as CVE-2026-45659, stems from an issue with the deserialization of unreliable data and allows attackers with minimal privileges to execute arbitrary code on unpatched SharePoint servers.

Technical Details and Exploitability

The vulnerability is particularly dangerous because it can be exploited with low complexity. According to Microsoft, which released patches in May for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, "an attacker does not require significant prior knowledge of the system and can achieve reproducible success with the payload against the vulnerable component."

CISA Alert and Deadlines for Federal Agencies

The CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on July 1, ordering federal executive civil agencies (FCEB) to secure their servers within three days. "This type of vulnerability is a frequent attack vector for hostile actors and poses significant risks to the federal enterprise," the agency warned. In a subsequent advisory, the CISA urged security teams to monitor affected servers for signs of exploitation, apply the latest Microsoft patches, verify successful installation, and shorten patching cycles.

Mitigation Recommendations

Among the recommended measures, the CISA suggested enabling Windows Antimalware Scan Interface (AMSI) integration for SharePoint web applications and using Microsoft Defender Antivirus (MDAV) detections to detect and remediate compromises. Shadowserver, an Internet security surveillance group, currently tracks over 8,500 Microsoft SharePoint servers exposed online, with more than 200 of them unpatched against the CVE-2026-45659 vulnerability.

Microsoft and the Lack of Official Updates

Despite the CISA alert, Microsoft has not yet updated the CVE-2026-45659 advisory to indicate that the vulnerability is actively exploited. However, the CISA updated the KEV catalog on Tuesday to confirm that the flaw is now used by ransomware gangs. Since November 2021, the agency has reported 14 actively exploited Microsoft SharePoint vulnerabilities, eight of which were also used in ransomware attacks.

Other Actively Exploited Critical Vulnerabilities

In June, the CISA confirmed that ransomware gangs are also exploiting a Microsoft Defender privilege escalation vulnerability, nicknamed BlueHammer, which was exploited as a zero-day to access the Security Account Manager (SAM) database, containing local account password hashes. The flaw, tracked as CVE-2026-33825, was publicly disclosed by a security researcher known as "Nightmare Eclipse" in early April, along with the exploit proof-of-concept code.

Implications for Corporate Security

As highlighted in the Blue Report 2026, which measures technical defenses technique by technique across 338 million simulations performed in customer production environments, overall prevention scores can hide what happens after the initial access. Once attackers use valid credentials, prevention drastically decreases. This underscores the importance of a multi-layered security approach and timely response to vulnerability advisories.