SharePoint CVE-2026-45659: The Deserialization That Leads to Warlock Ransomware

On-premise SharePoint servers remain a prime target for ransomware operators, because they are exposed, central to the document infrastructure, and often behind on patches. CVE-2026-45659 fits this pattern. Rated CVSS 8.8, it is a remote code execution arising from the deserialization of untrusted data. Microsoft released the fix, but active exploitation was confirmed by CISA and multiple vendors in early July 2026, which led to its addition to the Known Exploited Vulnerabilities catalog.

One set of attacks was attributed to Storm-2603, an actor known for deploying Warlock ransomware, often by exploiting known vulnerabilities in on-premise SharePoint servers since mid-2025. The chain therefore runs from the deserialization flaw to encryption, by way of webshell implantation.

The mechanism: deserialization and the authentication requirement

The vulnerability stems from SharePoint deserializing untrusted data, T1190 (Exploit Public-Facing Application). An important point for risk assessment: it can be triggered by an authenticated attacker with at minimum Site Member permissions, without other elevated privileges, and without user interaction. This low authentication threshold is deceptive: on a SharePoint where many accounts hold member access, or as soon as a valid credential is obtained elsewhere, the barrier is easy to clear. Affected products are SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.

Once RCE is achieved, the typical exploitation pattern is to implant a webshell, T1505.003 (Server Software Component: Web Shell), and to access the server's machine keys, which allows forging tokens and maintaining access even after patching.

The most reliable detection signal: w3wp spawns a shell

On a SharePoint server, the IIS worker process, w3wp.exe, serves web requests. It has no legitimate reason to launch a command interpreter or PowerShell. When it does, it is almost always the sign of an exploitation that has led to code execution. This is the most robust detection point, independent of payload details.

title: SharePoint worker process w3wp spawning a shell
id: 2b7e4f19-8c05-4a63-9d1f-6e0b3c7a2f58
status: experimental
description: >
  Detects w3wp.exe launching cmd or PowerShell on a SharePoint server, the
  post-RCE exploitation pattern (CVE-2026-45659, webshell).
references:
  - https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Very rare, document per the server's legitimate SharePoint extensions
level: high
tags:
  - attack.execution
  - attack.t1190
  - attack.t1505.003

Complement this rule with monitoring for unexpected .aspx file creation in SharePoint content directories, a marker of webshell implantation, and with an alert on access to the server's machine keys.

Check the version with Nuclei

On the inventory side, a Nuclei template lets you spot exposed SharePoint servers and estimate their version, to prioritize patching. On an internet-facing server, this check is urgent given the very short remediation deadline CISA imposed.

id: sharepoint-server-exposure
info:
  name: Exposed SharePoint server
  author: threatclaw
  severity: info
  description: Spots a reachable SharePoint server, to audit for CVE-2026-45659
  reference:
    - https://www.helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659/
  tags: sharepoint,cve-2026-45659,kev,rce
http:
  - method: GET
    path:
      - "{{BaseURL}}/_layouts/15/start.aspx"
      - "{{BaseURL}}/_vti_pvt/service.cnf"
    matchers-condition: or
    matchers:
      - type: word
        words:
          - "SharePoint"
          - "MicrosoftSharePointTeamServices"
        condition: or
      - type: status
        status:
          - 200
          - 401

The measures recommended by CISA and Microsoft

Beyond the patch, CISA and Microsoft recommend enabling AMSI integration on SharePoint and IIS worker processes, and setting the request body scan mode to Full, to allow detection of malicious POST payloads. They published AMSI and Microsoft Defender detection signatures for this vulnerability. CISA also advises reviewing telemetry for anomalous requests, suspicious worker-process activity, webshells, and machine-key access.

A crucial remediation point: applying the patch is not enough if the server has already been compromised. Attackers who accessed the machine keys can retain access. Full remediation therefore involves, on a potentially compromised server, rotating the machine keys and thoroughly hunting for webshells and persistence.

Covering this chain, from exposure to post-exploitation execution, requires both scan templates and up-to-date behavioral rules. That is what the ThreatClaw Nuclei feed provides: templates prioritized on real exploitation and aligned with the KEV catalog, to identify and address first what in your estate is genuinely at risk.