SharePoint Vulnerable DLL File Creation/Modification (CVE-2026-45454)

Ethan Andrews@eandrews

•updated Jun 15, 2026•9•0•24

This rule detects the creation or modification of specific SharePoint policy pages DLL files (microsoft.office.policy.pages.dll) that are known to be vulnerable to CVE-2026-45454. The detection is based on matching the SHA256 hashes of these vulnerable DLL versions. This indicates the presence or manipulation of a vulnerable component within a SharePoint environment.