SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation

CISA added CVE-2026-45659 (SharePoint Server deserialization RCE, CVSS 8.8) to its Known Exploited Vulnerabilities list citing active exploitation and urging agencies to patch; Microsoft’s investigation also revealed overlapping ransomware activity by Storm-2603 deploying Warlock and a separate actor using DLL side-loading and custom backdoors, with techniques including Velociraptor, Cloudflare tunneling, Zoho Assist, SSH via VS Code, privilege escalation and a vulnerable driver (NSecKrnl.sys) to evade security controls.