SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-45659 (CVSS score: 8.8), is a case of remote code execution arising from the deserialization of untrusted data. The issue

The article reports that CISA has added Microsoft SharePoint Server remote code execution vulnerability CVE-2026-45659 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog after evidence of active exploitation, affecting on‑prem SharePoint Server Subscription Edition, 2019, and Enterprise 2016 through deserialization of untrusted data.[1][3][4] Microsoft’s advisory notes that any authenticated low‑privilege user (e.g., Site Member) can remotely execute arbitrary code without admin rights or user interaction, and U.S. federal agencies are ordered to patch urgently.[1][4][5] From a CyberSE.AI perspective, AI and agent platforms that integrate with or depend on SharePoint for data access, knowledge bases, or workflow orchestration inherit this RCE risk: compromise of SharePoint can lead to downstream data leakage, manipulation of documents used to ground AI outputs, and abuse of AI agents that trust SharePoint as a canonical source. Organizations should treat vulnerable SharePoint instances as a critical part of their AI ecosystem, ensure rapid patching and build verification, and include these systems in AI security readiness assessments and threat models, particularly where AI