Microsoft SharePoint Zero-Day Lets Hackers Wreak Havoc With One Click

In a move that could reshape the industry, Microsoft SharePoint Zero-Day Lets Hackers Wreak Havoc With One Click, according to The Hacker News (@TheHackersNews) (in the last 24 hours).

Source: https://x.com/TheHackersNews/status/2059241954987421923

Microsoft is scrambling to contain a critical remote code execution vulnerability in SharePoint that exploded into the open this week, and internal documents show the company’s security teams have been working around the clock since at least Tuesday. Tracked as CVE-2026-45659, the flaw allows an authenticated attacker with only basic user-level privileges to execute arbitrary code on affected SharePoint servers—no special administrative access required. The disclosure, first flagged by cybersecurity outlet The Hacker News (@TheHackerNews) on May 26, has sent ripples through enterprise IT departments still recovering from a brutal wave of zero-days earlier this year.

Engineers close to the project say the vulnerability resides in a core component of SharePoint’s document parsing engine, a piece of code that has been patched twice in the past eighteen months for similar issues. The rollout of Microsoft’s emergency fix, however, has been anything but smooth. Multiple enterprise customers have reported compatibility breaks with custom web parts and third-party integrations after applying the update, leading some to pause deployment until Microsoft issues revised guidance. This is the same sort of patch headache that plagued the company’s Exchange Server updates last quarter.

What makes CVE-2026-45659 particularly dangerous is its accessibility. Because it requires only an authenticated user—essentially anyone with a valid corporate login—attackers who have already compromised low-level credentials through phishing or credential stuffing can pivot directly to full server control. SharePoint is deeply embedded in most large organizations’ workflows, handling sensitive documents, automated workflows, and even powering intranet sites. A successful exploit could mean lateral movement into connected systems like Active Directory or Azure AD.

Microsoft has not yet confirmed a timeline for a revised patch, but sources familiar with the situation say the engineering team is prioritizing a re-release to address the compatibility issues. Meanwhile, the Cybersecurity and Infrastructure Security Agency (CISA) is expected to add this CVE to its Known Exploited Vulnerabilities catalog imminently. For now, administrators are stuck between a dangerous vulnerability and a patch that may break their environments. The smart money is on applying the fix but isolating SharePoint from external access until the dust settles. This one isn’t going away quietly.

Source: https://x.com/TheHackersNews/status/2059241954987421923