CISA: Microsoft SharePoint RCE flaw now actively exploited

The U.S. CISA warns that attackers have begun exploiting a high-severity Microsoft SharePoint RCE (CVE-2026-45659) arising from unsafe deserialization, enabling low-privilege authenticated actors to run arbitrary code remotely. Microsoft released updates for affected SharePoint Server versions on May 21, CISA added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate, while Shadowserver reports over 10,000 SharePoint servers exposed online.