CVE-2026-45659: Microsoft SharePoint Unauthenticated RCE — Detection and Remediation Guide

---
title: Potential SharePoint RCE - w3wp.exe Spawning Shell
id: 8a4b3c9d-1e2f-4a5b-8c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of SharePoint RCE via w3wp.exe spawning command shells or PowerShell.
references:
  - CVE-2026-45659
author: Security Arsenal
date: 2026/04/01
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1190
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  filter_legit:
    # Filter out known legitimate administrative paths if necessary, but be cautious
    User|contains: 
      - 'ADMIN$'
      - 'MOSS_' # Standard SharePoint Service Accounts often contain this
falsepositives:
  - Legitimate administrative debugging (rare)
  - Custom scripts executed by administrators
level: critical
---
title: SharePoint w3wp.exe Outbound Network Connection
id: 9b5c4d0e-2f3g-5b6c-9d7e-0f1a2b3c4d5e
status: experimental
description: Detects suspicious outbound network connections initiated by SharePoint IIS worker process, indicative of reverse shell or C2 activity.
references:
  - CVE-2026-45659
author: Security Arsenal
date: 2026/04/01
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\w3wp.exe'
    Initiated: 'true'
  filter_standard_ports:
    DestinationPort not in:
      - 443
      - 80
      - 53
      - 88
      - 389
      - 636
      - 3268
      - 3269
      - 445
      - 135
      - 139
falsepositives:
  - SharePoint plugins connecting to external APIs
  - Search crawlers contacting external sources
level: high

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName == "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "regsvr32.exe", "rundll32.exe", "cscript.exe", "wscript.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by Timestamp desc

-- Hunt for w3wp.exe spawning suspicious child processes
SELECT Parent.Name AS ParentName, Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Parent.Name =~ "w3wp.exe"
  AND Name IN ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe")

# Script to verify SharePoint Patch for CVE-2026-45659
# Requires Administrator Privileges

$KBNumber = "KB504XXXXX" # REPLACE with actual Microsoft KB ID for CVE-2026-45659
$PatchInstalled = $false

Write-Host "[+] Checking for patch $KBNumber..." -ForegroundColor Cyan

# Check via Get-Hotfix
try {
    $Hotfix = Get-Hotfix -Id $KBNumber -ErrorAction SilentlyContinue
    if ($Hotfix) {
        Write-Host "[SUCCESS] Patch $KBNumber is installed. Installed On: $($Hotfix.InstalledOn)" -ForegroundColor Green
        $PatchInstalled = $true
    }
}
catch {
    # Get-Hotfix might fail if update superseded, check file versions as fallback
}

if (-not $PatchInstalled) {
    Write-Host "[WARNING] Patch $KBNumber was not found via Get-Hotfix." -ForegroundColor Yellow
    Write-Host "[+] Checking SharePoint DLL Versions..." -ForegroundColor Cyan
    
    # Common SharePoint DLL path
    $DLLPath = "${env:CommonProgramFiles}\microsoft shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.dll"
    
    if (Test-Path $DLLPath) {
        $FileVersion = (Get-Item $DLLPath).VersionInfo.FileVersion
        Write-Host "[INFO] Current Microsoft.SharePoint.dll Version: $FileVersion" -ForegroundColor White
        
        # Logic: Compare against a known patched version baseline. 
        # Defenders must update the MinimumPatchedVersion based on official advisory.
        $MinimumPatchedVersion = "16.0.17000.0000" # PLACEHOLDER VALUE
        
        if ($FileVersion -ge $MinimumPatchedVersion) {
            Write-Host "[INFO] File version indicates the system may be patched (verify $MinimumPatchedVersion)." -ForegroundColor Green
        } else {
            Write-Host "[ALERT] File version is below expected patched baseline. System likely vulnerable." -ForegroundColor Red
        }
    } else {
        Write-Host "[INFO] SharePoint DLL not found at standard path. Is SharePoint installed on this host?" -ForegroundColor Gray
    }
}