KEV Lag Tracker → CVE-2026-45659. Data verified against the official CISA KEV catalog and the National Vulnerability Database.
CISA added CVE-2026-45659 (Microsoft SharePoint Server) to the Known Exploited Vulnerabilities catalog on July 1, 2026. It was publicly known for 40 days before CISA confirmed active exploitation. A KEV listing is CISA’s official confirmation that a vulnerability is being exploited in the wild.
The Record
| CVE | CVE-2026-45659 |
| Vendor / product | Microsoft SharePoint Server |
| Vulnerability | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability |
| CVSS base score | 8.8 |
| NVD publication date | May 22, 2026 |
| Added to CISA KEV | July 1, 2026 |
| Lag (public → KEV listing) | 40 days |
| Federal patch deadline | July 4, 2026 |
| Known ransomware use | No |
Measured against the 1665 entries in our tracker with verified publication dates, CVE-2026-45659 was flagged faster than 67% of them.
What CISA Reported
CISA describes the flaw as follows: “Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.”
Federal Patch Deadline
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-45659 by July 4, 2026 — a 3-day remediation window from the KEV listing date. Private organizations are not bound by that deadline; CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
How This Compares to Microsoft’s Track Record
At 40 days, CVE-2026-45659 was flagged faster than Microsoft’s 567-day median across the 383 of its KEV entries with verified publication dates. Microsoft currently ranks #18 on our KEV Lag leaderboard.
| Microsoft in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 383 |
| Median lag (public → KEV listing) | 567 days |
| 0-day rate (exploited at or before disclosure) | 23% |
| Entries tied to known ransomware campaigns | 104 |
Other Recent Microsoft KEV Additions
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-68820 | Windows Ancillary Function Driver for WinSock | August 11, 2026 | 0 | No |
| CVE-2026-50522 | SharePoint | July 22, 2026 | 8 | No |
| CVE-2026-58644 | SharePoint | July 16, 2026 | 2 | No |
| CVE-2026-56155 | Active Directory Federation Services | July 14, 2026 | 0 | No |
| CVE-2026-56164 | SharePoint Server | July 14, 2026 | 0 | No |
Frequently Asked Questions
What is CVE-2026-45659?
CVE-2026-45659 is a vulnerability in Microsoft SharePoint Server (Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability) that CISA added to its Known Exploited Vulnerabilities catalog on July 1, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild.
How long was CVE-2026-45659 public before CISA confirmed exploitation?
40 calendar days, measured from its NVD publication date to the date CISA added it to the KEV catalog.
What is the federal patch deadline for CVE-2026-45659?
U.S. federal agencies must remediate CVE-2026-45659 by July 4, 2026, a 3-day window from the KEV listing date. Private organizations are not bound by that deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
Is CVE-2026-45659 used in ransomware campaigns?
CISA has not flagged CVE-2026-45659 as known to be used in ransomware campaigns. That field reflects confirmed campaign use, not the absence of risk.
How does this compare to other Microsoft vulnerabilities?
Across 383 Microsoft entries with verified publication dates, the median lag is 567 days and 23% were exploited at or before disclosure. CVE-2026-45659, at 40 days, is faster than that median.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
Primary Sources
- CISA Known Exploited Vulnerabilities Catalog — the official listing that confirms active exploitation, and the source of the KEV date on this page.
- NVD — CVE-2026-45659 — publication date, CVSS score and the full technical record.
- Vendor advisory — msrc.microsoft.com — Microsoft’s own disclosure, with the affected versions and the fix.
How We Track This
This page is generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No date or figure on this page is estimated or taken from a third-party source — they come directly from CISA and NVD records. Free to cite with attribution to CVEDaily (CC BY 4.0).