CISA sounds alarm on SharePoint Server flaws being used to break in right now
The US cyber agency says attackers are chaining three unpatched holes in self-hosted SharePoint to bypass logins, run code and stay hidden. Nearly 10,000 servers sit exposed online.
Key points
- CISA warned Tuesday that hackers are actively exploiting three flaws in self-hosted Microsoft SharePoint Server.
- The bugs, CVE-2026-32201, CVE-2026-45659 and CVE-2026-56164, affect every supported on-premises SharePoint version.
- Shadowserver counts roughly 10,000 SharePoint servers exposed to the internet, with over 800 still unpatched against two of the flaws.
- US federal agencies have until 17 July to patch CVE-2026-56164 or pull affected servers offline, under Binding Operational Directive 26-04.
- Since November 2021, CISA has flagged 11 SharePoint bugs exploited in attacks, 7 of them tied to ransomware.
CISA's advisory is the kind of note that lands in an SRE's inbox on a Tuesday and ruins the week.
The target is Microsoft SharePoint Server, the on-premises document and intranet platform that thousands of organisations still run inside their own data centres. Not SharePoint Online. The one your ops team maintains.
Attackers are chaining three separate holes. First, they bypass authentication. Remote code execution comes next, meaning they can run their own commands on the box. Then they steal IIS machine keys, the cryptographic secrets Windows web server software uses, which lets them keep coming back even after a reboot or a patch.
That last step is what makes this ugly. Rotate the passwords all you want. If the machine keys are gone, the attacker's still got a spare set.
How bad is the exposure?
Shadowserver currently tracks about 10,000 SharePoint Server instances exposed directly to the public internet. Over 800 are unpatched against CVE-2026-32201 and CVE-2026-45659. The count for CVE-2026-56164 isn't clear, and some of those boxes will be honeypots.
CISA also flagged two more SharePoint bugs Microsoft patched Tuesday, CVE-2026-55040 and CVE-2026-58644, as attractive targets even though neither has been caught in active exploitation yet.
All three actively exploited flaws are now on CISA's Known Exploited Vulnerabilities list. Federal agencies have until 17 July to fix CVE-2026-56164 or turn the servers off. Private companies face no such deadline, but the guidance is the same.
We've tracked CVE-2026-45659 across seven stories since it first appeared in May, and the pattern holding across all of them is consistent: each new advisory finds more servers still reachable from the open internet.
Should you worry?
Seven of the 11 SharePoint bugs CISA has flagged since 2021 have been used in ransomware attacks. Internet-facing SharePoint has become one of the reliable front doors for extortion crews, and that's not a coincidence.
What should IT teams actually do?
Patch, obviously. But the advisory is unusually blunt that patching alone won't cut it here.
The failure mode is the machine keys. If an attacker got in before you patched, they may already have them. Hunt for signs of intrusion first, clean up, then rotate the keys. Doing it the other way round is theatre.
The rest of the advisory covers things every SharePoint admin has heard for a decade. Enable AMSI (Windows Antimalware Scan Interface), so security tools can inspect what SharePoint is actually running. Run Microsoft Defender Antivirus on the servers. Block external access to the SharePoint Central Administration console. Put a Layer 7 reverse proxy in front, so a filtering server inspects web traffic before it touches SharePoint.
And the line that sits under all of it: don't put SharePoint Server on the public internet unless you genuinely have to.
The post-mortem will say it again. The patch was available, the box was on the internet, and nobody changed the order.
