Microsoft rolled out an out-of-band patch for a remote code execution vulnerability in SharePoint Server that any authenticated attacker can potentially exploit without requiring administrator or other elevated privileges.

Microsoft assigned the bug, tracked as CVE-2026-45659, a severity rating of 8.8 on the 10-point CVSS scale. The company described the vulnerability as one that attackers are less likely to exploit even though it involves low attack complexity, no user interaction, and minimal privileges. More here