A deserialization flaw in on-premises Microsoft SharePoint Server has moved from vendor disclosure to active ransomware exploitation in short order. CVE-2026-45659 was added to CISA’s Known Exploited Vulnerabilities catalogue on July 1, with federal agencies required to patch or mitigate by July 4. The threat actor confirmed in exploitation activity is Storm-2603, operating the Warlock ransomware family.
What the vulnerability does
CVE-2026-45659 carries a CVSS base score of 8.8 and affects three on-premises SharePoint Server versions: SharePoint Server 2016, SharePoint Server 2019, and SharePoint Subscription Edition. The flaw is a deserialization vulnerability in the SharePoint request handling pipeline. An authenticated attacker — or an attacker who can force authenticated interaction via social engineering — can craft a malicious serialised object that, when processed by the server, executes arbitrary code in the context of the SharePoint application pool.
The authentication requirement is worth examining carefully. CVSS 8.8 reflects that the attacker needs some level of access — but in practice, organisations with external-facing SharePoint portals, partner portals, or Entra-connected intranets often have a large population of users with basic authenticated access. Phishing a single credential is enough to stage the exploit. For environments where SharePoint is accessible from the internet with authentication, this is close to a pre-auth-equivalent risk.
Storm-2603 and Warlock ransomware
Storm-2603 is a financially motivated threat cluster tracked by Microsoft and independently by several threat intelligence vendors. The group operates Warlock ransomware and has been active across Europe, North America, and parts of Asia-Pacific throughout 2025-26. Their targeting profile is broad — they look for enterprise software with large installed bases and available exploits, pivot from initial access to domain-level credentials quickly, and move to encryption within 24-48 hours of gaining a foothold.
SharePoint Server fits their targeting model. Organisations still running on-premises SharePoint tend to be in sectors with older infrastructure or data sovereignty requirements: government, legal, healthcare, financial services, higher education. These are the same organisations whose data commands the highest ransom leverage.
The CISA KEV confirmation means exploitation is not theoretical or proof-of-concept. Storm-2603 has been successfully exploiting this in the wild before the KEV addition.
Exposure landscape
The on-premises SharePoint installed base is substantial but concentrated. Cloud migrations have taken many organisations to SharePoint Online over the past five years, which is not affected. Those remaining on SharePoint Server 2016, 2019, or Subscription Edition tend to be organisations where migration has been technically complex, contractually constrained, or deferred. Ironically, the organisations least prepared for rapid patch deployment are overrepresented in the affected population.
External-facing SharePoint deployments are the highest-risk category. SharePoint sites used for external partner collaboration, public portals, or contractor access should be treated as actively targeted until patched.
What to do now
Immediate priorities:
- Determine whether SharePoint Server 2016, 2019, or Subscription Edition is running in your environment. Cloud-hosted SharePoint Online is not affected.
- Apply Microsoft’s security update for CVE-2026-45659. Treat the July 4 federal deadline as relevant regardless of whether you are a federal agency — the threat actors are not limiting activity to government targets.
- If immediate patching is not possible: pull SharePoint back from external access at the network perimeter, require VPN for all SharePoint access, and increase authentication requirements (MFA is not optional here).
- Review SharePoint access logs for anomalous activity from the past two weeks. Focus on unusual serialisation-related request patterns, unexpected file writes to SharePoint directories, and any newly created accounts with elevated permissions.
- Engage incident response resources if you see indicators of Storm-2603 activity: credential dumping from LSASS, lateral movement via SMB, and staging of Warlock ransomware payloads are the characteristic post-exploitation signals.
For organisations with SharePoint Online: no action required for CVE-2026-45659 specifically, though the broader Storm-2603 campaign uses multiple initial access vectors. Credential hygiene and MFA remain baseline requirements.
The July 4 deadline is tight, and it falls over a US federal holiday weekend. That is not an accident — threat actors frequently time campaigns around periods when security teams are reduced. Organisations that cannot complete patching this week should have compensating controls in place and heightened monitoring through the holiday period.