SharePoint Server RCE — CVE-2026-45659

CVE-2026-45659 is a remote-code-execution flaw (CVSS 8.8) in on-premises Microsoft SharePoint Server, caused by deserialization of untrusted data. An attacker holding only Site Member permissions — no admin rights, no user interaction — can execute arbitrary code on the server in a low-complexity attack. Microsoft shipped the fix on 2026-05-21; a companion deserialization bug CVE-2026-47294 was patched in the same cycle. CISA added CVE-2026-45659 to the Known Exploited Vulnerabilities catalog on 2026-07-01 with a federal remediation deadline of 2026-07-05, despite Microsoft's original "Exploitation Less Likely" rating.

As of publication no atomic IOCs, webshell names, or threat-actor attribution are public — CISA states it is "not known how the vulnerability is being exploited." This pack is therefore behavior-based: it hunts the deserialization-RCE post-exploitation surface that is invariant across SharePoint code-execution bugs — the IIS worker process w3wp.exe spawning shells, script interpreters and compilers, dropping web-accessible .aspx handlers into the SharePoint web root, and beaconing outbound.

Defender priority: (1) Confirm every on-prem SharePoint farm is on the 2026-05-21 build or later — patching is the fix. (2) Run Q1 immediately: w3wp.exe spawning cmd/powershell/csc on a SharePoint server is the single highest-fidelity sign of successful exploitation. (3) After any suspected hit, rotate the farm's ASP.NET machine keys — deserialization/ViewState abuse survives a patch if leaked keys aren't rotated.

Intel gap (honest): exploitation details are not public. Every hunt here is behavior-based against the deserialization-RCE surface; the IOC appendix (§10) ships with REPLACE_WITH_… placeholders rather than fabricated indicators. Re-hunt this pack when a vendor publishes webshell names / infrastructure.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): Successful RCE surfaces as w3wp.exe (SharePoint app pool) spawning a shell or script interpreter.
2. H2 (high): Webshell installation compiles code on the fly — w3wp.exe spawning csc.exe/vbc.exe.
3. H3 (high): A web-accessible handler (.aspx/.ashx/.asmx) is written under the SharePoint web root by w3wp.exe.
4. H4 (high): Encoded / download-cradle PowerShell launched from w3wp.exe.
5. H5 (medium): Host/domain reconnaissance LOLBins spawned by w3wp.exe.
6. H6 (medium): Ingress-tool-transfer LOLBins (certutil/bitsadmin/curl/rundll32/regsvr32/mshta) spawned by w3wp.exe.
7. H7 (medium): The SharePoint IIS worker makes anomalous outbound connections to external IPs.

Attack chain

No atomic IOCs are published for CVE-2026-45659 as of 2026-07-03. The "indicators" below are behavioral/config facts drawn from Microsoft's advisory and CISA KEV — not fabricated hashes or C2. Treat the behavior signatures as the detection substrate; add atomic IOCs when a vendor publishes them.

• IIS W3C logs — POST requests to SharePoint endpoints under /_layouts/15/ or /_layouts/16/ with abnormally large bodies or __VIEWSTATE/__SUSPICIOUS parameters, especially from low-privilege (Site Member) accounts, and 200/500 spikes on those endpoints.
• SharePoint ULS logs — deserialization / type-load exceptions and unexpected application-pool recycles or w3wp crashes correlated with the requests above.
• Windows Security 4688 — child processes of w3wp.exe on SharePoint servers (mirror of Q1/Q2/Q5/Q6 if EDR coverage is partial).
• File Integrity Monitoring — new/modified files under %ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS and _app_bin not tied to a patch/admin change.
• Patch/build audit — confirm farm build is 16.0.19725.20280+ (SE) or the May-2026 CU for 2016/2019.

Scope every IOA to a SharePoint server host group so the w3wp.exe parent constraint stays meaningful. Promote the w3wp→shell and w3wp→ingress IOAs to prevention after one clean baseline window.

1 · Confirm the patch build (PowerShell, on a farm server)

# Farm build must be 16.0.19725.20280 or later (SE, May 2026 CU)
(Get-SPFarm).BuildVersion
# Or check the assembly directly:
(Get-Item "$env:CommonProgramFiles\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.dll").VersionInfo.ProductVersion

2 · Enable AMSI + verify Defender (Central Admin / PowerShell)

# AMSI Full-mode integration ships in current SharePoint builds and is enabled
# via Central Administration > Security > "Manage antimalware / AMSI" (Full mode).
# Verify Defender AV is present and running on every farm server:
Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled
# Then recycle: IISReset /noforce  (run on each server after enabling)

3 · Rotate machine keys + recycle (post-patch)

# Rotate the farm's ASP.NET machine keys using Microsoft's documented
# key-rotation procedure for your SharePoint version, then across ALL servers:
IISReset /noforce
# Re-run Q3/Q7 afterward to confirm no residual webshell or beacon.

4 · WDAC/IOA guard — block w3wp shelling out (concept)

# Falcon Custom IOA (recommended): Parent ImageFileName ends \w3wp.exe
#   AND Child ImageFileName in (cmd.exe, powershell.exe, csc.exe, mshta.exe,
#   certutil.exe) on the SharePoint host group -> Block.
# WDAC alternative: deny-rule these child binaries when parent is w3wp.exe.

Two gaps are inherent to this pack: the exploit request itself (T1190) is best seen in IIS/ULS/WAF telemetry rather than EDR, and no atomic IOCs are public yet — the §10 CSV is reserved with placeholders and should be filled the moment a vendor publishes webshell/C2 indicators. The behavioral queries Q1–Q6 cover the post-exploitation chain durably. Validation gates in §11 must pass before promoting any query to prevent.