Microsoft quietly shipped a fix for CVE-2026-45659, a flaw in SharePoint Server, during May 2026 Patch Tuesday, but didn't publish the bulletin until later and initially played down the risk. The catch is that a user with only "Site Member" access, the standard permission for anyone who can contribute to a site and sometimes even external guests, can use it to run code on the server. CISA later added it to its Known Exploited Vulnerabilities catalog, confirming attackers were actively using it.
The story here isn't just one bug. It's that a patch can exist for weeks while the risk stays under the radar, and permissions you set up years ago quietly become an attack path.
If you run SharePoint on your own servers, confirm the May 2026 update is installed, then audit who has Site Member access and strip out stale or guest accounts. More broadly: don't assume "low likelihood" ratings are the final word, and review the standing permissions on any collaboration tool at least once a year.
Further reading: original source ↗
Want this handled for you?
This is exactly the kind of thing our website security work takes off your plate. Start with a free, no-pressure look at your site.
Come aboard