Patch released in May: Ransomware attacks Microsoft Sharepoint

Administrators managing Microsoft SharePoint Server within their infrastructure should verify whether they have installed the May updates, according to a recent alert. A high-risk vulnerability in SharePoint, identified as CVE-2026-45659 with a CVSS score of 8.8 and a risk rating of “high,” has been actively exploited in ransomware campaigns. This information was published in the Known Exploited Vulnerabilities Catalogue by the U.S. Cybersecurity & Infrastructure Security Agency (CISA) on Tuesday. The vulnerability allows attackers to inject and execute malicious code, making it a critical concern for organizations using affected systems. Microsoft made available security patches for SharePoint Enterprise Server 2016, SharePoint Server 2019, and the Server Subscription Edition in late May. These updates address the specific flaw that enables remote code execution through deserialization of untrusted data. However, despite these efforts, scans conducted by the Shadowserver Foundation revealed over 200 publicly accessible and unpatched SharePoint servers on the internet. Of these, approximately half are located in the United States, around a quarter in Europe, and a dozen in Germany. Austria and Switzerland show lower numbers, though additional cases may exist that were not detected during the scan. As of early June, Shadowserver had previously recorded nearly 1,100 unpatched instances of SharePoint online. The vulnerability exploits a flaw in how SharePoint processes serialized data, allowing attackers to run arbitrary code without requiring elevated privileges. This means that even unauthorized users could potentially exploit the weakness remotely, including from the internet. The method involves injecting malicious payloads into serialized objects, which are then deserialized by the application, leading to code execution. Such attacks are considered low complexity because attackers need minimal prior knowledge about the target system to carry them out. Microsoft initially assessed the likelihood of exploitation as relatively low, assigning a CVSS Temporal Score of 7.7 in May. Despite this, the active use of the vulnerability in real-world ransomware attacks suggests that the threat level has increased significantly. The CISA update confirms that the vulnerability is being used in ongoing cybercriminal activities, emphasizing the urgency for administrators to apply the necessary patches. Security experts warn that the widespread availability of unpatched SharePoint servers creates a large attack surface for potential breaches. The number of vulnerable systems still online indicates a lack of awareness or enforcement of patch management protocols among some organizations. While Microsoft has taken steps to provide fixes, the continued presence of exposed systems highlights gaps in cybersecurity practices. The situation underscores the importance of regular software updates and proactive security measures. Organizations running SharePoint must ensure all systems are up to date with the latest security patches. In addition, network monitoring and intrusion detection systems can help identify and respond to suspicious activity before it leads to a breach. As ransomware attacks continue to evolve, staying ahead of emerging threats requires constant vigilance and adherence to best practices in information security.