As reported by CISA, three vulnerabilities in Microsoft SharePoint Server are being actively exploited in the wild, with threat actors chaining remote code execution with sophisticated post-exploitation techniques including IIS machine key harvesting and deserialization abuse. This is not a theoretical risk — it is an ongoing, confirmed campaign against enterprise infrastructure that organizations may already be hosting on their perimeters.

Security Impact: As reported by CISA, three vulnerabilities in Microsoft SharePoint Server are being actively exploited in the wild, with threat actors chaining remote code execution with sophisticated post-exploitation techniques including IIS machine key harvesting and deserialization abuse.

Vulnerability Summary

CVE-2026-32201
Active exploitation confirmed. Added to CISA KEV on April 14, 2026. Enables unauthorized access to on-premises SharePoint Server instances.
CVE-2026-45659
Active exploitation confirmed. Added to CISA KEV on July 1, 2026. Involved in RCE and post-exploitation activity chains.
CVE-2026-56164
Active exploitation confirmed. Added to CISA KEV on July 14, 2026. Used alongside deserialization techniques to establish persistence and deploy malware.
CVE-2026-55040 & CVE-2026-58644
No known exploitation at time of advisory. Microsoft has flagged these as high-risk if unpatched. Treat as exploitation-imminent given current threat activity.
Affected Products
Microsoft SharePoint Server — Subscription Edition, 2019, and 2016 (all supported on-premises versions)
Patch Available
Yes — Microsoft has released patches. Verify successful installation; deployment alone is insufficient.
Active Exploitation
Confirmed for CVE-2026-32201, CVE-2026-45659, CVE-2026-56164

Why This Is More Dangerous Than a Typical Patch Advisory

What elevates this situation beyond a standard patching bulletin is the post-exploitation sophistication being observed. Stealing IIS machine keys is not a noisy, easily detectable action — it enables attackers to forge encrypted tokens and authentication artifacts that appear entirely legitimate to the server. Once an adversary holds valid machine keys, they can perform ViewState deserialization attacks that persist even after the original vulnerability is patched. In other words: patching fixes the entry point, but does not evict an attacker already inside.

This is the critical nuance that many incident response teams miss. Security teams that apply patches and declare themselves remediated may be leaving active implants — particularly IIS-resident webshells and backdoors like Backdoor:MSIL/LeakFang.A!dha — still operational on their SharePoint farms.

Who Is Most Exposed

On-premises SharePoint deployments remain extremely common across:

Why This Is More Dangerous Than a Typical Patch Advisory
Government and public sector agencies — often running older, compliance-gated patch cycles
Legal, financial, and healthcare firms — using SharePoint as a document management backbone, often directly accessible from corporate networks
Manufacturing and critical infrastructure — where SharePoint integration with operational systems creates lateral movement opportunities
Mid-market enterprises — that have not yet migrated to SharePoint Online and lack dedicated security operations to detect subtle post-exploitation behavior

Organizations that have SharePoint exposed directly to the internet — even behind a VPN — are at the highest immediate risk. The presence of SharePoint Central Administration reachable externally is a particularly dangerous configuration that should be remediated on an emergency basis.

The IIS Machine Key Problem: A Compounding Threat

Security teams should understand that machine key rotation, while necessary, is not safe to perform blindly. If a key harvester artifact is already resident on the server when keys are rotated, attackers may capture the new keys as well, negating the remediation. This requires a hunt-first, rotate-second approach: forensically validate the integrity of the SharePoint environment before rotating any cryptographic material.

Shield53 Analyst Note: Treat any SharePoint server that was internet-accessible and unpatched after April 14, 2026 as potentially compromised until forensically proven otherwise. Absence of alerts is not absence of compromise.

Shield53 Immediate Actions

Priority 1 — Within 24 Hours

  • Apply all available Microsoft patches for SharePoint Server (Subscription Edition, 2019, 2016) and verify successful installation — do not rely solely on deployment confirmation
  • Isolate any internet-facing SharePoint instances behind an authenticated Layer 7 reverse proxy or WAF capable of request body inspection
  • Block all external access to SharePoint Central Administration immediately

Priority 2 — Within 48–72 Hours

  • Enable AMSI integration in Full Mode for all SharePoint web applications and validate detection rule coverage for Exploit:Script/SuspSignoutReqBody.A, ToolPaneAuthBypass.A, and ToolPaneAuthBypass.C
  • Hunt for webshells, anomalous SharePoint worker process activity, and unauthorized access to IIS configuration paths before rotating machine keys
  • Search for MDAV detection hits on Backdoor:MSIL/LeakFang.A!dha across all SharePoint servers — a positive hit indicates active post-exploitation activity requiring full incident response
  • Review SharePoint and IIS logs for unusual /_layouts/ requests, tool pane anomalies, and sign-out request body irregularities dating back to at least April 2026

Priority 3 — Ongoing Hardening

  • Restrict farm-to-database communications to required systems only using host-based firewall rules
  • Implement enhanced logging per CISA's event logging best practices guidance, focusing on SharePoint ULS logs, IIS W3C logs, and Windows Event forwarding
  • Evaluate migration timeline to SharePoint Online for workloads where on-premises hosting no longer provides operational necessity
  • Shorten your SharePoint patching SLA to 72 hours for Critical/High severity advisories — standard 30-day cycles are inadequate for actively exploited vulnerabilities

Organizations that discover indicators of compromise should report to CISA's 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA and initiate formal incident response procedures. The window between initial exploitation and lateral movement in these observed campaigns is measured in hours, not days.