Ransomware Comes for On-Prem SharePoint, Again

CISA quietly updated its Known Exploited Vulnerabilities catalog today to mark CVE-2026-45659 — a deserialization RCE in on-premises SharePoint Server — as actively used in ransomware campaigns. The flaw was patched back in May, added to the KEV on July 1 with an unusually tight three-day federal deadline, and affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and Subscription Edition. The CVSS 8.8 bug lets an authenticated user with ordinary site-member permissions execute arbitrary code on the server.

If this feels familiar, it should. It's a near-exact rerun of July 2025's ToolShell campaign, down to the cast: Microsoft has tied the exploitation to Storm-2603, the same group that chained CVE-2025-49704, CVE-2025-49706, and CVE-2025-53770/53771 against on-prem SharePoint a year ago — and it's dropping the same Warlock ransomware. That repetition is the real story. This is no longer an incident. It's a business model, and the product is your SharePoint farm.

"Exploitation Less Likely" keeps being wrong

When Microsoft shipped the May fix, it rated the bug "Exploitation Less Likely." CISA's KEV addition five weeks later made that assessment look bad; today's ransomware flag buries it. And this isn't an isolated miss — by BleepingComputer's tally, fourteen SharePoint vulnerabilities have been flagged as actively exploited since November 2021, and eight of those ended up in ransomware operations.

The problem is structural. The Exploitability Index measures how hard an exploit is to build, not how profitable it is to use. A deserialization bug requiring "authenticated access" sounds gated until you remember what SharePoint is: a collaboration platform where nearly every employee holds site-member rights somewhere, and where infostealer logs and credential dumps supply valid logins for a few dollars. For an operator like Storm-2603, PR:L is a rounding error, not a barrier. ToolShell at least required no auth; this one shows the gangs will happily pay the small extra cost of one phished account when the payoff is domain-adjacent code execution.

If you're using Microsoft's exploitability ratings to triage patches on internet-facing collaboration servers, stop. For this product category, the honest prior is: any RCE will be weaponized within weeks of patch diffing, regardless of the label.

The end-of-support squeeze

Here's the part none of the advisories dwell on: two of the three affected versions just died. SharePoint Server 2016 and 2019 both left extended support on July 14, 2026 — the same day, as it happens, that CISA published its SharePoint hardening alert. Those farms received the May patch before the cutoff, but that's the last one. Every SharePoint bug disclosed from here on lands on 2016 and 2019 as a forever-day.

That changes the calculus for the long tail of orgs still running these versions — typically because of compliance and data-residency requirements, or because a decade of custom farm solutions and timer jobs won't survive a migration. Those were defensible reasons to stay on-prem when patches still shipped. They aren't anymore. An internet-reachable SharePoint 2019 box in August 2026 is in the same category as an exposed Exchange server after ProxyShell: a standing invitation with a countdown you can't see.

The exposure numbers make the point concretely. Shadowserver counts more than 8,500 SharePoint servers reachable from the internet, with 200-plus still unpatched against CVE-2026-45659. Two hundred sounds small until you consider selection effects: a server that missed a two-month-old, KEV-listed patch is exactly the kind of environment where the ransomware also finds flat networks, stale backups, and no EDR.

What to actually do this week

If you operate on-prem SharePoint, patching is step one, not the whole job — and if your server was exposed before you patched, assume compromise until you've disproven it.

• Patch to the May 2026 updates on Subscription Edition, 2019, and 2016 if you somehow haven't. Then verify the build number actually moved; SharePoint patching fails silently more often than admins like to admit.
• Rotate your ASP.NET machine keys and restart IIS. This was the hard lesson of ToolShell: attackers who touched the box steal the ValidationKey, which lets them forge __VIEWSTATE payloads and re-enter after you patch. A patched-but-previously-compromised server is still a compromised server.
• Hunt retroactively. The known tells: w3wp.exe spawning cmd.exe or PowerShell, unfamiliar .aspx files under LAYOUTS or other web-served paths, and DLL search-order hijacking artifacts — a documented Storm-2603 technique from the 2025 campaign.
• Turn on AMSI integration in Full Mode with Defender AV. It's been Microsoft's default guidance since ToolShell and it blocks the commodity versions of these exploit chains.
• Get the farm off the public internet. VPN or an authenticating reverse proxy in front. If a business unit insists on anonymous external access to SharePoint in 2026, that's an argument to escalate, not accommodate.

And if you're on 2016 or 2019: your real project isn't this patch, it's the migration — to Subscription Edition if regulated data keeps you on-prem, to SharePoint in Microsoft 365 if it doesn't. Budget for the farm-solution rewrite now, because the next CVE won't come with a fix for you.

The uncomfortable conclusion

Microsoft's own incentives here point one direction: it has been steering customers off on-prem SharePoint for years, and a shrinking, EOL-heavy install base gets a shrinking share of hardening attention. Meanwhile Storm-2603 has now run the same profitable play two summers in a row. Betting that there's no third act — with fewer patches coming and the same 8,500 servers sitting exposed — isn't risk tolerance. It's denial. On-prem SharePoint can still be run safely, but only deliberately: patched fast, gatewayed, monitored, and on a supported version. As a default, set-and-forget deployment on the open internet, it's finished.