24JUL

SharePoint patch clock runs out today

2 min read

18:20UTC

CISA gave federal agencies three days to remediate an actively exploited SharePoint code-execution flaw, with today's deadline the tightest on the catalogue.

← Back to Zimbra zero-click, and a 15-nation reply Jump to analysis ↓

TechnologyDeveloping

Key takeaway

SharePoint's three-day KEV deadline lands today, the tightest federal patch clock of the fortnight.

CISA, the US federal cyber-defence agency, added CVE-2026-45659, a remote-code-execution (RCE) flaw in Microsoft SharePoint Server, to its Known Exploited Vulnerabilities (KEV) catalogue on Wednesday 1 July, with a Federal Civilian Executive Branch (FCEB) remediation deadline of today, Saturday 4 July. That is a three-day window on the most widely deployed on-premises collaboration platform across government and enterprise estates. The catalogue lists ransomware use as "Unknown". ¹

The flaw falls under BOD 26-04, the risk-tiered Binding Operational Directive that replaced patch-by-deadline enforcement on 10 June . A deserialisation-of-untrusted-data vulnerability lets an attacker feed crafted input that the server rebuilds into running code, and SharePoint's ubiquity across on-premises estates is what makes a three-day clock uncomfortable. Nothing else on the catalogue this fortnight runs tighter.

Deep Analysis

In plain English

SharePoint is a Microsoft tool that companies and governments use to share documents and manage internal websites. A flaw was found in the version installed on an organisation's own servers, rather than Microsoft's version, that lets an attacker send it corrupted data and gain control of the machine. The US government's cyber-defence agency ordered its own agencies to fix the flaw within three days of listing it, an unusually tight deadline, even though nobody has yet confirmed a ransomware gang is actively using it. The urgency comes from experience: a similar SharePoint flaw last year was used to break into government and manufacturing networks worldwide within about two weeks of becoming public.

Deep Analysis

Root Causes

CISA's BOD 26-04, which replaced the flat two-week patching mandate of BOD 22-01 on 10 June, sorts vulnerabilities into risk tiers with compressed deadlines for internet-facing remote-code flaws; a three-day window here is the tiering working as designed, not an emergency exception.

Many federal agencies still run SharePoint Server on-premises rather than the cloud version, often because of data-residency rules or a decade of custom workflow additions, which keeps a legacy deserialisation attack surface alive long after Microsoft's own roadmap pushed customers toward the hosted product.

What could happen next?

Risk
Agencies still running on-premises SharePoint Server face the same three-day clock regardless of patch-testing capacity, raising the odds some will remediate late, as happened with the Splunk and Ubiquiti deadlines this same fortnight (ID:4471, ID:4473).
Precedent
If exploitation follows the ToolShell timeline, ransomware use could move from Unknown to confirmed within two to three weeks of the 1 July listing.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: July 2025's 'ToolShell' SharePoint on-premises exploit chain (CVE-2025-53770) went from its exploited-vulnerability listing to mass ransomware use by the Warlock and Storm-2603 crews within roughly two weeks, hitting government and manufacturing targets worldwide.

Counter-parallel: 2019's SharePoint deserialisation bug, CVE-2019-0604, stayed confined to a handful of targeted espionage intrusions linked to the China-based APT27 group rather than becoming a mass event, because Microsoft's patch reached most customers before public proof-of-concept code circulated.

Consensus view: Rapid7's Caitlin Condon assesses that the three-day federal remediation window, 1 to 4 July, is unusually compressed for a deserialisation bug and reflects CISA applying its BOD 26-04 risk tiers aggressively, even though the catalogue entry itself lists ransomware use as Unknown.

Counter-view: China's Qihoo 360 Netlab team argues the compressed deadline reacts to confirmed exploitation rather than anticipating it, and notes that SharePoint's deserialisation flaw class has recurred since 2019 without Microsoft closing the underlying design pattern that keeps producing it.

Key tension: Whether a three-day remediation clock without a confirmed ransomware link protects agencies ahead of exploitation, or simply outruns their patch-testing cycles and pushes some to miss the deadline entirely.

Sources:CISA

Mentions:FCEB →Microsoft →China →CISA →CVE-2026-45247 →Microsoft SharePoint →BOD 26-04 →Rapid7 →Known Exploited Vulnerabilities →

First Reported In

Update #9 · FortiBleed harvest linked to Lynx crew

CISA· 4 Jul 2026

Read original →

Causes and effects

Caused by

CISA tears up its KEV deadline rules

BOD 26-04's risk-tiered framework set the remediation window applied to the SharePoint deserialisation flaw.

Occurred 10 Jun 2026

Read story →

This Event

SharePoint patch clock runs out today

A three-day deadline on the most widely deployed on-premises collaboration server is the first hard test of how fast agencies can move under the new triage regime.

Led to

SharePoint stays under active KEV fire

CISA's three-day SharePoint deserialisation KEV deadline set on 1 July is escalated by two further SharePoint deserialisation CVEs landing on 16 and 22 July.

Occurred 22 Jul 2026

Read story →

Different Perspectives

AIVD

AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.

CNCERT

China's national CERT was not party to AA26-204A and has previously argued that Western KEV-based advisories conflate demonstrated exploit capability with confirmed breach impact. It is expected to treat this fortnight's coalition-based Russia attribution as a Five Eyes-led exercise rather than an independently verified finding.

Russia

Moscow has not publicly responded to the AA26-204A attribution naming LAUNDRY BEAR as a Russian state-supported actor behind the Zimbra zero-click chain. Russian officials have consistently denied state involvement in prior Western cyber-attribution advisories, a pattern this fifteen-agency coalition is likely to meet with the same denial.

National Crime Agency

The NCA called the Woolwich Crown Court sentencing of Owen Flowers and Thalha Jubair Britain's largest-ever cybercrime prosecution. It expects continued pressure on Scattered Spider's UK-linked membership, alongside City of London Police's push for statutory Cyber Crime Risk Orders.

CISA

CISA co-led AA26-204A naming LAUNDRY BEAR and added five more flaws to KEV this fortnight, including a three-day Oracle EBS deadline, while absorbing a one-month detection-to-listing gap on FortiSandbox. It expects the risk-tiered BOD 26-04 model to hold even as a proposed $707m FY27 cut threatens the staffing behind it.

UK managed service providers and data centre operators

Newly brought into critical-infrastructure scope by the Cyber Security and Resilience Bill's Lords second reading, facing fines up to £17m or 4% of global turnover and a new near-miss reporting duty they did not previously carry. The sector moves from best-practice guidance to statutory exposure within this Parliamentary session.