Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

Who is affected

How to fix it

Microsoft SharePoint Server is affected by a deserialization vulnerability that can allow an authorized attacker to execute code over the network. Apply the Microsoft security update, restrict SharePoint administration and upload paths, and review farms for webshells or unauthorized changes. Prioritize internet-facing SharePoint farms and environments with broad contributor access.

1. Inventory all SharePoint Server farms, web front ends, application servers, and version/build numbers.
2. Apply the Microsoft security update for CVE-2026-45659 on every SharePoint server in the farm.
3. Run SharePoint configuration wizard or required post-update steps so the farm schema and services are consistent.
4. Restrict Central Administration, PowerShell remoting, and high-risk endpoints to trusted admin networks.
5. Review uploaded files, web parts, layouts, timer jobs, farm solutions, and IIS directories for unauthorized code or webshells.
6. Rotate SharePoint farm, service account, database, and application credentials if suspicious execution is found.
7. Remove unsupported custom components or isolate them until they are confirmed compatible with the patched farm.

Verify the fix

• Confirm every SharePoint server reports the Microsoft fixed build for CVE-2026-45659.
• Validate farm upgrade status is healthy and no server remains on an older build.
• Review ULS, IIS, Windows event, and security logs for deserialization or code execution indicators.
• Test document upload, search, authentication, workflows, and critical site collections after patching.
• Run a Fixnx scan and confirm no public SharePoint administrative exposure remains.

Related categories

Trusted references

FAQ