CVE-2026-45659 SharePoint RCE Actively Exploited by Ransomware

Microsoft's 'Less Likely' assessment for CVE-2026-45659 has become a catastrophic misjudgment, as ransomware gangs are now actively weaponizing the SharePoint remote code execution vulnerability to compromise enterprise networks.

The flaw, tracked as [CVE-2026-45659](https://nvd.nist.gov/vuln/detail/CVE-2026-45659), is a critical deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint Server Subscription, 2019, and 2016 editions. According to a CISA alert issued July 1, 2026, threat actors identified as "Storm-2603" are exploiting this vulnerability to deploy "Warlock" ransomware. The evidence is clear: despite a patch being available since May 2026, the vulnerability was added to [CISA's Known Exploited Vulnerabilities (KEV) Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), confirming active and widespread attacks in the wild.

Note what this means: a vendor's risk assessment is a prediction, not a shield. The global exploit development ecosystem operates on a different set of incentives, where any authenticated, low-complexity RCE is a guaranteed target for weaponization. The failure here is systemic; organizations that align their patch velocity to a vendor's subjective likelihood rating are structurally vulnerable to actors who move at the speed of offense.

[Visual Graphic 1]

Anatomy of a SharePoint Exploit Chain

CVE-2026-45659 is not being exploited in a vacuum. Threat intelligence from firms like [Mandiant](https://www.mandiant.com/resources/blog/storm-2603-exploits-sharepoint-cve-2026-45659) shows that Storm-2603 is chaining multiple vulnerabilities together to achieve its objectives. The attack begins with exploiting a flaw like CVE-2026-32201, an unauthenticated spoofing bug, to gain initial network access and the low-privilege credentials required to trigger the main RCE.

Once authenticated as a user with simple 'Site Member' permissions, the attacker leverages CVE-2026-45659. They submit a specially crafted serialized object to a vulnerable SharePoint endpoint. The server, failing to properly validate this data, deserializes it and executes the embedded malicious code in the context of the SharePoint application pool, achieving remote code execution. This is a classic example of [Exploiting Public-Facing Applications](https://attack.mitre.org/techniques/T1190/), a staple of initial access campaigns.

Post-exploitation, actors have been observed using a third vulnerability, CVE-2026-56164, for privilege escalation. The goal is often to steal IIS machine keys, allowing them to decrypt sensitive configuration data, forge authentication cookies, and move laterally across the network. It seems Storm-2603 did not receive Microsoft's memo on the 'less likely' chance of this all happening.

> 🧠 CISO Brief: The true risk of CVE-2026-45659 is not just RCE; it is the entry point to a full-domain compromise. Your SharePoint server is a trusted internal device, often with privileged access to backend databases and Active Directory. A breach here is a breach everywhere.

This chained attack methodology demonstrates a sophisticated understanding of the target environment and maximizes impact from a single entry point.

Storm-2603 and the Warlock Ransomware Payload

Storm-2603 is the designated threat actor actively weaponizing this SharePoint RCE. Their payload of choice, Warlock ransomware, is deployed following successful exploitation and lateral movement. The deployment signifies the final stage of an attack that began with a seemingly low-risk vulnerability.

According to an [IBM X-Force report](https://www.ibm.com/xforce/blog/threat-actors-weaponize-deserialization-flaws/), the speed from exploit publication to ransomware deployment is shrinking. In this case, it was a matter of weeks. The Warlock payload follows a standard double-extortion model: encrypting critical files while exfiltrating sensitive data to a leak site, pressuring victims into paying the ransom.

> ⚠️ BreachModal Insight: If you were the CISO here, you would have seen anomalous w3wp.exe (the SharePoint worker process) activity in your logs, spawning unusual child processes like `powershell.exe` or `cmd.exe`. This is the signal that the RCE payload has detonated. This is not just a 'security incident'; it is the precursor to a full-blown ransomware event.

Organizations running vulnerable SharePoint versions are not just at risk of a data breach; they are facing operational shutdown.

[Visual Graphic 2]

Remediation is More Than Just a Patch

The critical remediation failure we are observing is incomplete patching. Merely applying the May 2026 security update is insufficient if the server was already compromised. CISA explicitly warns that attackers may have already deployed web shells or other key-harvesting artifacts *before* the patch was applied.

Applying the patch closes the front door, but it doesn't evict an intruder who is already inside. Therefore, the remediation sequence is non-negotiable:

1. Isolate and Patch: Take the server offline if possible, apply the relevant SharePoint security update, and then run the SharePoint Products Configuration Wizard (PSConfig.exe) to finalize the installation. 2. Hunt for Compromise: Use Microsoft Defender Antivirus (MDAV) and enable AMSI integration for SharePoint to scan for and remove any malicious files, web shells, or scheduled tasks. 3. Rotate All Credentials: This is the most critical step. After confirming the server is clean, you must rotate the IIS machine keys and all SharePoint service account credentials. Failing to do this means any previously stolen keys remain valid, rendering the patch effectively useless against an embedded attacker.

> 🧩 Tactical Note: The SharePoint RCE exploitation via CVE-2026-45659 highlights the danger of monolithic, on-premise applications. The blast radius of a single vulnerability is immense, a pattern we also detailed in our analysis of the [[Exchange Hafnium Attacks]].

Shortening the patch cycle for critical, internet-facing infrastructure is the only viable defense.

Proof of Concept: Executing Code via CVE-2026-45659

The following steps provide a high-level overview for demonstrating remote code execution against a vulnerable SharePoint server. This requires an authenticated user with at least Site Member permissions.

1. Target Identification & Authentication

First, confirm the target SharePoint server is running an affected version (e.g., SharePoint Server 2019 build prior to the May 2026 CU). Obtain valid credentials for a low-privilege user (e.g., 'Site Member') through legitimate means or a separate exploit.

2. Payload Generation

Use a tool like `ysoserial.net` to generate a serialized payload. The payload will leverage a known deserialization gadget within .NET and SharePoint components to execute a command, such as `whoami`.

```bash ./ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -o base64 -c "cmd.exe /c whoami > C:\Windows\Temp\poc.txt" ```

This command creates a Base64-encoded payload that, when deserialized, executes `whoami` and writes the output to a file on the server.

3. Crafting the Exploit Request

The generated payload must be embedded within a specific parameter of an HTTP POST request sent to a vulnerable SharePoint API endpoint. This requires knowledge of the specific endpoint that improperly handles deserialization.

```http POST /_api/vulnerable/endpoint HTTP/1.1 Host: vulnerable-sharepoint.local Content-Type: application/json Cookie: FedAuth=[...]

{ "serializedData": "AAEAAAD/////AQAAAAAAAAAEAQAAACJTeX...[YSERIAL_PAYLOAD]..." } ```

The `FedAuth` cookie handles authentication, and the `serializedData` field contains the malicious payload.

4. Verifying Execution

After sending the request, check the server for the presence and content of the output file `C:\Windows\Temp\poc.txt`. If the file exists and contains the username of the SharePoint application pool account (e.g., `nt authority\network service`), the RCE was successful.

FINAL VERDICT

The active exploitation of CVE-2026-45659 is a direct indictment of relying on vendor risk assessments over ground-truth threat intelligence. The risk is not theoretical; it is an active ransomware campaign impacting organizations that failed to patch a 'less likely' vulnerability. The burden of this risk is borne by IT and security teams who must now treat every authenticated RCE as 'exploitation inevitable' and shorten patch cycles accordingly. To defend against this and future threats, organizations must move beyond reactive patching and adopt a continuous, proactive security posture.

BreachModal offers Adversary Simulation and Emergency Breach Response services to help you validate your defenses against threats like Storm-2603. [Contact us to secure your collaboration platforms.](https://breachmodal.com/contact)