On July 1, CISA added a high-severity Microsoft SharePoint Server vulnerability to its Known Exploited Vulnerabilities catalog after confirming attackers are already using it in the wild — and researchers have since tied the exploitation to a ransomware crew. If your small business runs an on-premises SharePoint server (common in law firms, medical practices, and manufacturers around York County), your IT provider should have patched it days ago. If they haven't, you're in the target zone.
What the vulnerability actually does
The flaw, tracked as CVE-2026-45659, is a case of remote code execution arising from the deserialization of untrusted data , with a CVSS score of 8.8 . It affects on-premises SharePoint — not SharePoint Online in Microsoft 365. Specifically, the issue was addressed by Microsoft in May 2026 for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016 .
The scary part is how little access an attacker needs. Microsoft noted that any authenticated attacker could trigger the vulnerability, and that it does not require admin or other elevated privileges. In a network-based attack, an authenticated attacker with a minimum of Site Member permissions could leverage it to execute code remotely on the SharePoint Server. Site Member is the standard contributor role most employees hold. In other words, one compromised employee login — via phishing, a reused password, or a stolen session — is enough to hand an attacker code execution on your document server.
Microsoft originally rated real-world exploitation as "less likely." CISA's action this week directly overrides that.
Ransomware crews are already using it
This isn't theoretical. According to reporting on the CISA KEV listing, CVE-2026-45659 is being actively exploited by Storm-2603 to deploy Warlock ransomware . That's the same threat actor Microsoft has previously linked to on-prem SharePoint attacks.
Why SharePoint? Because it's usually the file-and-collaboration hub — everything from HR records to contracts to client files lives there. SharePoint often houses business-critical data, and the malicious actor can likely pivot from SharePoint to other Windows infrastructure to continue their activities. Once ransomware is inside SharePoint, it typically doesn't stay there.
There's also a timing problem. Microsoft patched the flaw on May 12, 2026, but the 52 days between patch availability and CISA's KEV addition means many organizations have been running open exposure throughout June. Attackers had a two-month head start.
What your MSP should be doing this week
If you outsource IT — or you have an internal tech person backed up by co-managed IT support — here's the short list of questions to put in front of them today:
1. Do we run any on-premises SharePoint Server (2016, 2019, or Subscription Edition)? Many small businesses aren't sure. If the answer is "I don't know," that itself is the problem. 2. Confirm the May 2026 Microsoft security update is installed on every SharePoint server and every server in the farm. If you run SharePoint in a multi-server farm, validate build versions across the farm, not just on a single host.
3. Audit who has Site Member or higher permissions. Revoke access for ex-employees, ex-contractors, and unused guest accounts. 4. Check whether any SharePoint front-end is exposed to the public internet. If it is, ask why — and whether it needs to be. 5. Verify offline, tested backups exist for the data SharePoint holds. This is a ransomware story, not just a patch story.
The CISA directive told federal civilian agencies to apply Microsoft's fixes no later than July 4, or discontinue use of affected systems if mitigations aren't available. Private businesses aren't legally bound by that deadline, but the ransomware crews don't care about the difference. Ongoing patch management, permission audits, and monitored backups are exactly the kind of work that lives inside a proper managed IT program — not a break-fix relationship where nobody looks at your servers until something breaks.
What York Businesses Should Do
York County has a lot of professional-services firms, medical practices, and small manufacturers still running on-prem SharePoint for document storage — often on aging Windows Server boxes tucked in a closet. If you're not sure whether yours is patched or whether it's reachable from the internet, that's a conversation to have with York Computer or your current IT provider this week, not next month.
Sources
- CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability
- SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
- CISA: Microsoft SharePoint RCE flaw now actively exploited
- SharePoint RCE CVE-2026-45659: Patch Before July 4 Deadline
- CISA KEV Catalog Entry — CVE-2026-45659
- CISA adds SharePoint flaw to known exploited vulnerabilities list