Microsoft SharePoint had five vulnerabilities added to CISA's Known Exploited Vulnerabilities catalogue between 14 July and 18 August 2026 — five weeks, five confirmed-exploited bugs, one product.
| CVE | CVSS | What it is | Ransomware use | Added to KEV |
|---|---|---|---|---|
| CVE-2026-58644 | 9.8 | Deserialization of untrusted data — unauthorized RCE | Unknown | 16 Jul 2026 |
| CVE-2026-50522 | 9.8 | Deserialization of untrusted data — unauthorized RCE | Unknown | 22 Jul 2026 |
| CVE-2026-55040 | 9.1 | Weak authentication — security bypass | Unknown | 18 Aug 2026 |
| CVE-2026-45659 | 8.8 | Deserialization of untrusted data — authorized RCE | Known | 1 Jul 2026 |
| CVE-2026-56164 | 5.3 | Missing authentication — privilege elevation | Unknown | 14 Jul 2026 |
Read the NVD descriptions closely and a pattern inside the pattern appears: three of the five are deserialization of untrusted data. Not three different bug classes that happen to share a product. The same root cause, three times, in five weeks.
Deserialization is the class that keeps producing this
Deserialization bugs share a property that makes them unusually productive for attackers and unusually resistant to a single fix: the vulnerability is not in what the code does with the data after deserializing it — it is in the act of deserializing at all. If an object graph built from attacker-controlled input can trigger code execution as it is reconstructed, no validation written after that point runs in time to stop it. That is why "deserialization of untrusted data" shows up in CVE descriptions across dozens of products and years rather than being patched into non-existence once — each instance is a different code path with the same structural flaw, and finding one does not preclude a sibling nearby.
CVE-2026-45659 needs an authorized attacker — someone with a valid, if limited, account — while CVE-2026-58644 and CVE-2026-50522 do not. That distinction matters for how each is reached, but not for what happens once it lands: all three describe code execution, on a server that in most organisations holds document libraries, internal wikis, and the authentication trust relationships between them.
The remaining two are different in kind. CVE-2026-55040 is a weak-authentication bypass — the check exists and can be defeated, rather than being absent. CVE-2026-56164 is missing authentication for a critical function entirely, and is the only one of the five where privilege elevation, not code execution, is the direct outcome.
Why SharePoint specifically absorbs this much attention
SharePoint sits in an unusual position for attackers: it is a document repository, an intranet, an authentication-adjacent service, and — because Microsoft integrates it tightly with the rest of the 365 ecosystem — frequently a stepping stone toward mail, identity, and file storage that a company assumed were separately secured. A single RCE on a SharePoint server is rarely the end goal; it is a beachhead with an unusually good view of everything else.
CVE-2026-45659's confirmed ransomware use is the fact that should set the priority order here. It requires authorization, which sounds like a mitigating factor until you remember what ransomware operators do first: use a phished or purchased credential to get exactly that.
What to check this week
Patch against the current cumulative update, not a specific KB. Five distinct CVEs in five weeks means an org that patched for the first one and stopped checking is behind by the time it reads this.
Audit who holds "authorized" access on your SharePoint deployment. CVE-2026-45659 needs an account, not an anonymous connection — and confirmed ransomware use means that bar has already been cleared against real targets.
Look for deserialization exposure beyond the patched CVEs. Three confirmed instances of the same root cause in five weeks is evidence about the code, not just about three isolated bugs — the next one is plausibly still there.
Don't treat CVE-2026-56164's 5.3 score as low priority in isolation. Missing authentication for a critical function is a precondition-remover: paired with any of the RCE bugs above, it turns "needs an account" into "needs nothing."
How Safeguard helps
Safeguard's continuous inventory tracks internal platforms like SharePoint with the same rigor as internet-facing services, because — as this cluster shows — the line between "internal" and "reachable by an attacker who already has one foothold" is thinner than the network diagram suggests. Reachability analysis is what separates the SharePoint instance sitting behind three layers of access control from the one an authorized-but-compromised account can reach directly, which is the distinction CVE-2026-45659's confirmed ransomware use makes anything but theoretical.
