CISA Adds SharePoint RCE Flaw to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability affecting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday, citing evidence of active exploitation. This vulnerability, designated CVE-2026-45659, carries a CVSS score of 8.8 and allows for remote code execution through the deserialization of untrusted data. The inclusion in the KEV catalog mandates that federal agencies patch this vulnerability by a specific deadline to mitigate risks.

Microsoft had previously released a security advisory and patches for this flaw in its August 2026 security update. The vulnerability specifically targets SharePoint Server and enables an unauthenticated attacker to execute arbitrary code on the affected server. This could lead to a complete compromise of the server and any sensitive data it hosts. The urgency of the KEV addition underscores the real-world threat posed by this exploit, as attackers are actively leveraging it.

Organizations utilizing Microsoft SharePoint Server are strongly advised to review Microsoft's security guidance and apply the necessary patches immediately. Failure to do so could expose their systems to significant security risks, including data breaches and service disruptions. CISA's KEV catalog serves as a critical resource for identifying and prioritizing the remediation of vulnerabilities that pose the most immediate threat to U.S. networks.