CVE-2026-45659 Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

Exploitation active constatée

· catalogue CISA KEV

Action attendue Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Campagnes de rançongiciel Utilisation connue

Faiblesse CWE-502

Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
Microsoft SharePoint Enterprise Server 2016 16.0	16.0.0 → < 16.0.5552.1002	16.0.5552.1002
Microsoft SharePoint Server 2019 16.0	16.0.0 → < 16.0.10417.20128	16.0.10417.20128
Microsoft SharePoint Server Subscription Edition 16.0	16.0.0 → < 16.0.19725.20280	16.0.19725.20280

Autres CVE de Microsoft SharePoint Enterprise Server 2016

Les 337 CVE de Microsoft SharePoint Enterprise Server 2016 →

CVE-2026-97783 Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint… 8.1 Élevée CVE-2026-69943 Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows… 8.8 Élevée CVE-2026-62917 Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a… 4.6 Moyenne CVE-2026-62839 Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing… 6.5 Moyenne