HookProbe Claims Multi-Layer Detection of Critical SharePoint Deserialization Flaw

A critical deserialization vulnerability, CVE-2026-45659, has been identified in Microsoft SharePoint Server, allowing an authenticated attacker with low-level permissions to execute arbitrary code over a network. The flaw lies in how SharePoint handles certain SOAP-based requests and internal API calls during document metadata processing, enabling attackers to trigger malicious gadget chains via crafted serialized payloads. Successful exploitation could lead to data exfiltration, installation of backdoors, lateral network movement, or full domain compromise if service accounts are over-privileged. Security platform HookProbe claims to address the threat through three detection engines — HYDRA, NAPSE, and AEGIS — operating across multiple OSI model layers to intercept malicious payloads even when obfuscated. The article, published on DEV Community, is a technical promotional piece by HookProbe and does not represent an independent security advisory.