CVE-2026-45659: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

This vulnerability affects Microsoft SharePoint Server and involves deserialization of untrusted data. An authorized attacker can execute code over a network. It matters because the flaw resides in a widely deployed collaboration platform that often holds internal documents and connects to broader enterprise networks.

How it works

The weakness is categorized under CWE-502. The server accepts serialized data from an authenticated user and deserializes it without sufficient validation, allowing the resulting object graph to trigger code execution.

Exact data formats, required permissions, or network paths must be confirmed against the vendor advisory rather than assumed from the class description.

Am I affected? How to find it in your systems

Microsoft SharePoint Server is typically deployed on-premises as part of intranet or document-management infrastructure. Inventory all SharePoint Server installations through configuration management databases, server asset lists, or PowerShell queries against farm members.

• Compare installed builds and service-pack levels against the vendor advisory to determine exposure.
• Review web-application and service-application configurations that accept user-supplied serialized content.
• Examine authentication logs and IIS logs for unusual POST or SOAP requests from accounts that normally perform limited actions.

How to remediate

Apply the vendor update referenced in the advisory as the primary step. Follow CISA BOD 26-04 guidance when prioritizing the deployment across internet-exposed or high-value assets.

• After patching, review SharePoint farm configuration to ensure default deserialization settings have not been altered.
• Limit the number of accounts granted elevated privileges that could reach the affected code path.

If you can't patch immediately

Place SharePoint servers behind network segmentation that restricts inbound traffic to only necessary management and client subnets. Disable or restrict any web parts, web services, or custom code paths that accept serialized input until the update is applied.

• Enable enhanced logging on the SharePoint servers and forward events to a central SIEM for detection of anomalous deserialization attempts.
• Consider virtual patching through a web-application firewall that inspects and blocks known-bad serialized payloads, confirming rule coverage against the vendor advisory.

If your data may have been exposed

Actively exploited vulnerabilities lead to breaches. Readers can run a free exposure scan of their email to check known breach data.