Microsoft Patches Critical SharePoint RCE Flaw CVE-2026-45659. Any Authenticated User Can Exploit It.

Microsoft has released security updates addressing a critical remote code execution vulnerability in SharePoint Server that requires no specialised conditions or elevated privileges to exploit. Any authenticated attacker with minimum site access can trigger the flaw and execute code remotely on the server.

The vulnerability, tracked as CVE-2026-45659, carries a CVSS score of 8.8 and has been rated important severity. It affects multiple versions of Microsoft SharePoint Server and was patched in Microsoft's most recent update cycle. For GCC security teams that have been managing a significant enterprise patching backlog, this adds another critical item requiring immediate attention.

How the Vulnerability Works

The flaw stems from the deserialization of untrusted data within Microsoft Office SharePoint. Deserialization vulnerabilities arise when an application reconstructs data from a serialised format, such as a network request, without adequately validating that data before processing it. An attacker who can craft a specifically structured request can abuse the deserialization process to inject and execute arbitrary code in the context of the SharePoint application.

In practical terms, an attacker who holds a minimum of Site Member permissions on a targeted SharePoint deployment can send a specially crafted request over the network that triggers the deserialization vulnerability, leading to remote code execution on the SharePoint Server. Microsoft's advisory states clearly that no administrator privileges are required and no user interaction is needed beyond the attacker's own authenticated access.

This lowers the barrier to exploitation significantly compared with many RCE vulnerabilities, which require either elevated privileges or the ability to trick an authenticated user into taking an action. Any user with a SharePoint account, whether a current employee, a contractor, or a former employee whose account has not been fully deprovisioned, represents a potential exploitation path. Identity and access management weaknesses across the GCC, where 80% of breaches in 2025 involved compromised credentials, make this risk profile particularly acute.

The vulnerability was discovered and responsibly disclosed by a researcher identified as MEOW. The deserialization nature of the flaw is consistent with a broader class of .NET vulnerabilities, including the ASP.NET machine key abuse technique previously documented by Microsoft in the context of ViewState deserialization attacks. The attack surface for this class of vulnerability is well understood by sophisticated threat actors.

Why This Matters for GCC Enterprises

SharePoint Server remains one of the most widely deployed collaboration and document management platforms across enterprise environments in the GCC and MENA region. Large financial institutions, government entities, healthcare organisations, and enterprise groups across Saudi Arabia and the UAE rely on SharePoint as a central document repository, intranet, and workflow platform.

An RCE vulnerability that any authenticated internal user, or any attacker who has obtained a single set of credentials, can exploit without further escalation represents a significant lateral movement and data exfiltration risk within already-compromised environments. The Verizon DBIR 2026 noted that AI-detected vulnerabilities now account for 31% of all breaches, with threat actors using AI to shrink defender response windows from months to hours. A critical SharePoint vulnerability that becomes publicly known will attract automated exploitation attempts within that compressed timeframe.

In organisations where SharePoint hosts sensitive financial, legal, operational, or human resources documents, successful exploitation could have material consequences well beyond the SharePoint platform itself. For context, Marks and Spencer reported a 23.8% profit drop following a cyber incident that disrupted operations across the first half of its financial year. The business impact of a platform compromise at the scale of an enterprise SharePoint deployment can extend far beyond the initial technical breach.

The Credential and Access Risk Context

The minimum permission threshold required to exploit CVE-2026-45659 means that the attack surface extends to every user account in the SharePoint environment. In large GCC enterprises, SharePoint environments frequently include thousands of user accounts, contractor accounts, and service accounts, many of which may not be actively monitored for anomalous behaviour.

GCC cybersecurity leaders have consistently warned that passwords and weak credential hygiene represent the primary vulnerability in regional enterprise environments. An attacker who has obtained a single set of low-privilege SharePoint credentials through phishing, credential stuffing, or a prior breach now has everything required to exploit this vulnerability. The EvilTokens phishing-as-a-service platform compromised over 340 Microsoft 365 organisations in five weeks by hijacking OAuth consent flows, demonstrating how efficiently credential access can be obtained and weaponised at scale.

Recommended Actions

Security and IT teams should apply the available Microsoft patch immediately. SharePoint Server patching should be treated as a priority equivalent to a critical internet-facing vulnerability, even for internal deployments, because the authentication requirement provides only partial protection in environments where credential compromise is common.

Organisations that cannot patch immediately should assess whether SharePoint Server instances are accessible from the broader corporate network to users who should not have Site Member permissions, and restrict access accordingly as a temporary control measure. Reviewing and reducing the scope of SharePoint site membership to the minimum required for business operations reduces the number of accounts that could be used to exploit the flaw.

The vulnerability's deserialization nature also makes it worth reviewing SharePoint-related network traffic for unusual POST request patterns, and ensuring that SharePoint Server is included within the scope of any active vulnerability management programme. Application security across the GCC has been identified as the primary attack surface for adversaries targeting regional enterprises, and SharePoint, as a widely used web-based platform, falls squarely within that category.

Microsoft has made updates available for all affected SharePoint Server versions through its standard update channels. The full advisory is available through the Microsoft Security Response Centre.