Back Feeds.4Sysops

CISA confirms SharePoint flaw is now fueling ransomware attacks

Feeds.4Sysops •IT News • August 11, 2026

CISA has confirmed that ransomware groups are exploiting CVE-2026-45659, a high-severity remote code execution flaw in Microsoft SharePoint Server. More than 200 internet-exposed SharePoint servers remain unpatched, making the warning especially urgent for organizations running on-premises deployments. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Exploits Critical SharePoint Vulnerability CVE-2026-45659 CISA has confirmed that ransomware groups are actively exploiting a critical vulnerability (CVE-2026-45659) in Microsoft SharePoint Server, which allows remote code execution. Over 200 unpatched SharePoint servers are currently exposed on the internet, primarily in the USA and Europe. The vulnerability arises from the deserialization of untrusted data, enabling attackers to inject malicious code without needing elevated privileges. Microsoft released security updates for affected SharePoint versions in May 2026, but many organizations have not yet applied these patches. The urgency for remediation is heightened as the exploitation is confirmed to be in progress. Shadowserver Foundation's scans indicate a significant drop in unpatched instances since June, but risks remain. Organizations running on-premises SharePoint deployments are particularly at risk. 4 sources 73

Extracted Entities

CISA confirms SharePoint flaw is now fueling ransomware attacks

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)