Exploitation of SharePoint vulnerabilities enables remote code execution and sensitive IIS key theft

Summary

Cyberattackers are targeting Internet-exposed Microsoft SharePoint Servers using three distinct vulnerabilities that allow for authentication bypass and remote code execution (RCE). CISA has added these flaws to its Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation in the wild.

The attack chain involves performing deserialization techniques to gain control over a system, followed by post-exploitation steps such as stealing Internet Information Services (IIS) machine keys. This theft enables attackers to maintain persistence and deploy malware across compromised environments. Shadowserver currently tracks nearly 10,000 Internet-exposed SharePoint servers, with more than 800 identified as unpatched against CVE-2026-32201 and CVE-2026-45659.

Technical details

The exploitation targets all supported self-hosted SharePoint Server versions: Subscription Edition, 2019, and 2016. Attackers use these flaws to bypass authentication and execute code remotely. Once access is established, they target IIS machine keys, which are critical for the security of the web application environment.

The vulnerabilities currently being exploited in the wild include:

• CVE-2026-32201 (Added to KEV April 14, 2026)
• CVE-2026-45659 (Added to KEV July 1, 2026)
• CVE-2026-56164 (Added to KEV July 14, 2026)

Microsoft has also identified two additional vulnerabilities that are not yet known to be exploited but are considered attractive targets: CVE-2026-55040 and CVE-2026-58644.

Detection opportunities

Defenders can use Microsoft Defender Antivirus (MDAV) and the Antimalware Scan Interface (AMSI) to identify ongoing or attempted exploitation.

Specific detection signatures include:

• AMSI: Exploit:Script/SuspSignoutReqBody.A - Used for request body scanning on SharePoint Server Subscription Edition.
• AMSI: Exploit:Script/ToolPaneAuthBypass.A - Used for request header scanning on SharePoint Server 2016, 2019, and Subscription Edition.
• AMSI: Exploit:Script/ToolPaneAuthBypass.C - Provides RCE coverage for SharePoint Server 2016, 2019, and Subscription Edition.
• MDAV: Backdoor:MSIL/LeakFang.A!dha - Alerts on post-exploitation activity involving IIS-protected secrets.

Organizations should establish tailored logging to monitor for anomalous requests, suspicious SharePoint worker-process activity, webshells, and unauthorized machine-key access.

Defender guidance

Patching is the primary defense. Federal agencies have until July 17 to secure servers affected by CVE-2026-56164 under Binding Operational Directive (BOD) 26-04. All organizations should apply the latest Microsoft security updates and verify that installations complete successfully.

To harden SharePoint environments, implement these specific actions:

• Enable AMSI Integration: Configure AMSI for each SharePoint web application using "Full Mode" for the Request Body Scan Mode where feasible.
• Secure IIS Keys: Before rotating IIS machine keys, hunt for and remove intrusion artifacts such as machine-key harvesters to prevent immediate re-theft of the new keys.
• Network Isolation: Avoid direct Internet exposure of SharePoint servers. If exposure is required, place servers behind a Layer 7 reverse proxy or an application-layer security control that requires authentication and can inspect/filter requests.
• Access Control: Block external access to SharePoint Central Administration and restrict farm and database communications strictly to required systems.