# There's a SharePoint bug hackers are already using, and the US just gave itself one day to fix it

> CVE-2026-45659 lets attackers run code on SharePoint Server with no login needed. CISA gave US agencies until July 4 to patch it.

- Published: 2026-07-03
- Topic: [Security](https://futuretechnologyhq.com/topic/security/)
- URL: https://futuretechnologyhq.com/article/sharepoint-rce-cve-2026-45659-active-exploitation/
- Publisher: [Future Technology](https://futuretechnologyhq.com/), free to read. Quote as "Future Technology" with a link to the article.

## Key points

- CISA added CVE-2026-45659, a SharePoint Server remote code execution flaw, to its Known Exploited Vulnerabilities list after confirming active attacks
- The bug has a CVSS score of 8.8 and lets attackers run code on a server without valid credentials, exploiting how SharePoint deserializes untrusted data
- US federal agencies were given until July 4, 2026 to patch, one of the tightest deadlines CISA has issued this year
- A second actively exploited bug, CVE-2026-8037 in Progress Kemp LoadMaster, carries a CVSS of 9.6 and hit the same week

## Article

A working exploit for a SharePoint server needs no password. That's the part worth sitting with. CVE-2026-45659 lets an attacker send a single crafted request and get code execution on the box, no login screen, no stolen credentials, no phishing email required. CISA confirmed it's already being used in the wild and added it to the Known Exploited Vulnerabilities catalogue this week.

## What the bug actually does

The flaw sits in how SharePoint Server deserializes untrusted data. Deserialization bugs are a recurring pattern in enterprise software because the process of turning stored data back into usable objects can be tricked into running attacker-supplied code instead. CVE-2026-45659 carries a CVSS score of 8.8, and because it doesn't require authentication, the attack surface is anyone who can reach the server over the network, not just people with an account.

CISA's response tells you how seriously it's being taken. US federal agencies were given until July 4, 2026 to patch, a same-week turnaround that's about as tight as the agency hands out. That deadline lands today.

## It's not the only one

The same week brought a second actively exploited bug: CVE-2026-8037 in Progress Kemp LoadMaster, an OS command injection flaw with a CVSS of 9.6 that lets attackers run arbitrary code on load balancers. Two high-severity, actively-exploited bugs surfacing in the same window isn't a coincidence worth ignoring. It's the kind of clustering security teams watch for, because attackers often probe multiple enterprise products at once once one technique proves it works.

## Why it matters beyond government IT

SharePoint sits at the centre of how most large organisations move documents, connect email, and manage internal file shares. A working RCE against it isn't a narrow bug, it's a direct line into whatever SharePoint touches. If your organisation runs on-prem SharePoint Server rather than the cloud-hosted Microsoft 365 version, this is a patch-today problem, not a next-sprint one. Cloud-hosted SharePoint Online customers are not affected the same way since Microsoft manages patching on its side.

This kind of flaw also tends to have a longer tail than the headline suggests. Once a working exploit is public or actively used, unpatched servers stay exposed for months, because on-prem infrastructure often lags behind cloud services in patch cycles. If you're not sure whether your organisation runs on-prem SharePoint, that's worth confirming with IT today rather than assuming someone else already checked.

For more on how these deserialization-style enterprise bugs compare to other recent infrastructure risks, see our coverage of the [ESA data breach caused by hardcoded credentials](https://futuretechnologyhq.com/european-space-agency-data-breach-2026/) and the [Amazon One Medical data exposure claim](https://futuretechnologyhq.com/amazon-one-medical-data-breach-claim/). Enterprise IT spend is also climbing fast right now, which we covered in [Samsung's $648 billion AI chip investment](https://futuretechnologyhq.com/samsung-648-billion-ai-chip-investment/), a reminder that security budgets are competing with AI infrastructure budgets for the same dollars.

## Key takeaways

- A working exploit for a SharePoint server needs no password, allowing an attacker to send a single crafted request and gain code execution.
- The flaw, CVE-2026-45659, sits in how SharePoint Server deserialises untrusted data, allowing attackers to run code instead of turning stored data back into usable objects.
- The attack surface is anyone who can reach the server over the network, not just people with an account, due to the lack of authentication required.
- US federal agencies were given until July 4, 2026 to patch the vulnerability, with the deadline landing today.
- A second actively exploited bug, CVE-2026-8037 in Progress Kemp LoadMaster, has also been identified, with a CVSS score of 9.6.
- SharePoint sits at the centre of how most large organisations move documents, connect email, and manage internal file shares, making a working RCE against it a significant risk.

## Sources

- [The Hacker News](https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)