AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

🔥 This vulnerability is being actively exploited in the wild (CISA Known Exploited Vulnerabilities catalog)

CVE-2026-45659: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

highvulnerability🔥 Actively Exploited

security

Source: CISA Known Exploited VulnerabilitiesJune 30, 2026CVE-2026-45659

Summary

Microsoft SharePoint Server has a deserialization of untrusted data vulnerability (a flaw where the software unsafely processes data from an untrusted source, allowing an attacker to inject malicious code), which lets an authorized attacker run code over a network. This vulnerability is actively being exploited in real attacks. Organizations must apply security updates following CISA's BOD 26-04 guidance by July 4, 2026, or stop using the product if no fix is available.

Solution / Mitigation

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk guidance. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. See https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659 for vendor-specific details and https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk for patching guidelines.