Critical SharePoint Flaws Under Active Attack: CISA Confirms Exploitation Chain

Microsoft SharePoint Server, the backbone of document collaboration for thousands of enterprises, is under active siege. On July 14, 2026, CISA confirmed that threat actors are exploiting multiple critical vulnerabilities in on-premises SharePoint deployments

chaining flaws together to achieve unauthenticated remote code execution, steal cryptographic keys, and establish persistent footholds deep inside corporate networks.

Three CVEs CVE-2026-32201 (CWE-20, improper input validation), CVE-2026-45659 (CWE-502, unsafe deserialization), and CVE-2026-56164 (CWE-306, missing authentication) have all been added to CISA’s Known Exploited Vulnerabilities catalog, triggering binding remediation deadlines for federal agencies.

Critical SharePoint Flaws

Microsoft simultaneously disclosed three more critical flaws: CVE-2026-55040 (a JWT authentication bypass), CVE-2026-58644, and CVE-2026-50522 (both unauthenticated deserialization RCE bugs). CVE-2026-58644 was added to the KEV catalog just days later, on July 16.

Affected products include SharePoint Server Subscription Edition, 2019, and 2016. SharePoint Online and Microsoft 365 are not impacted, since Microsoft manages patching for those cloud environments directly.

Critical SharePoint Flaws Under Active Attack: CISA Confirms Exploitation Chain

According to CISA and Microsoft’s technical analysis, the attack chain typically unfolds in stages. Attackers first identify exposed SharePoint instances via Shodan scans or certificate transparency logs, then send crafted HTTP requests exploiting the authentication or deserialization flaws to gain code execution inside the IIS worker process.

From there, they deploy web shells such as the now-notorious spinstall0.aspx to extract the server’s ASP.NET machineKey values (validationKey and decryptionKey) directly from web.config.

This key theft is the most dangerous part of the chain. With stolen machine keys, attackers can forge signed ViewState payloads using tools such as ysoserial.net, allowing them to execute code the server implicitly trusts even after the original vulnerability is patched.

Some intrusions have escalated further through malicious IIS modules registered in applicationHost.config, which persist across reboots and patch cycles by loading into every worker process on the server.

“SharePoint sits at a trust intersection most organizations underestimate it talks to Active Directory, SQL Server, and IIS simultaneously, so a single unpatched endpoint doesn’t just leak documents, it hands attackers a bridge into the entire identity fabric of the enterprise,” says a senior threat intelligence analyst tracking the campaign.

According to Rsecurity, once inside, attackers can pivot laterally using the farm service account’s elevated SQL Server privileges, reaching content databases, configuration data, and eventually Active Directory itself. For regulated industries like finance and healthcare, this isn’t just a technical incident; it’s a potential compliance and breach-disclosure event.

Security teams should treat any internet-facing, unpatched SharePoint farm as compromised until proven otherwise. Priority actions include:

Apply the July 14, 2026 security updates across all farm servers immediately.
Enable AMSI integration with Request Body Scan set to Full mode where feasible.
Hunt for web shells, unusual IIS modules, and anomalous w3wp.exe child processes.
Rotate machine keys only after confirming the environment is clean.
Restrict direct internet exposure to SharePoint and block external access to Central Administration.

Microsoft has indicated a companion RCE component tied to CVE-2026-55040 may still be outstanding, with a fix expected in the August 2026 update cycle, meaning this story is far from over.