The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that threat actors are actively exploiting a high-severity remote code execution (RCE) vulnerability affecting on-premises Microsoft SharePoint Server. The flaw, tracked as CVE-2026-45659, is caused by insecure deserialization of untrusted data, allowing authenticated attackers with only Site Member permissions to remotely execute arbitrary code on vulnerable SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016 deployments without requiring administrator privileges or user interaction. Although Microsoft released patches in May 2026 after the vulnerability was inadvertently omitted from its original May security updates and initially assessed exploitation as “Less Likely,” attackers rapidly weaponized the flaw, prompting CISA to add it to its Known Exploited Vulnerabilities (KEV) Catalog. In response, the agency ordered U.S. federal civilian agencies to remediate affected systems or discontinue use if mitigations are unavailable. While CISA has not attributed the attacks or disclosed their scale, more than 10,000 internet-exposed SharePoint servers remain visible online, underscoring the significant attack surface. The incident highlights the speed at which threat actors can reverse engineer newly released patches, reinforces SharePoint’s continued role as a common target for ransomware and other intrusion campaigns, and emphasizes the critical importance of rapidly patching internet-facing systems to reduce the risk of compromise. CTIX analysts strongly urge any affected administrators to patch and follow the CISA guidance to prevent compromise.