CISA Warns of Active Attacks on SharePoint Servers, Urges Immediate Patching
Three flaws are being chained to break into on-premises SharePoint, steal cryptographic keys, and plant malware. Two more just disclosed could be next.
Key points
- CISA confirmed active exploitation of three SharePoint Server flaws, CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, that let attackers run their own code on the server.
- Every supported on-premises version is affected: Subscription Edition and 2019 and 2016.
- CVE-2026-55040 and CVE-2026-58644 are patched but haven't been seen in attacks yet, according to Microsoft.
- CISA added the three exploited CVEs to its Known Exploited Vulnerabilities catalog on April 14, July 1, and July 14, 2026.
- Attackers are stealing IIS machine keys to keep access even after patches are applied.
Hackers are actively chaining three separate flaws to break into on-premises SharePoint servers, CISA confirmed this week. SharePoint is Microsoft's document-sharing and intranet software that many organisations run on their own hardware rather than in the cloud.
The bugs being exploited are CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164. Together they give an attacker remote code execution, the ability to run any command on the target machine as if they were sitting at its keyboard. We first reported CVE-2026-32201 on 28 May 2026.
What are the attackers actually doing once they get in?
They're stealing the server's IIS machine keys. IIS is the web-server software SharePoint runs on top of, and its machine keys are secret values used to sign and encrypt data passed between the browser and the server. Steal those keys and you can forge trusted requests, meaning a patched server can still be re-entered using the stolen secrets.
CISA's advisory describes the follow-on activity as deserialization attacks, a technique where the server is tricked into turning attacker-supplied data into a live program object, along with webshells, small hidden scripts that let the attacker send commands over normal-looking web traffic. Microsoft contributed to the alert and flagged two more freshly disclosed bugs, CVE-2026-55040 and CVE-2026-58644, not yet seen in attacks but needing patches all the same.
What should administrators do right now?
Apply Microsoft's latest SharePoint security updates, verify the install completed, and shorten patch cycles where possible. That's step one and it isn't optional.
Step two is enabling Antimalware Scan Interface (AMSI) integration, a Windows feature that lets antivirus tools inspect scripts and web requests before they run, for every SharePoint web application, with Request Body Scan Mode set to Full Mode where the environment can handle it. Microsoft has published signatures that catch the observed exploit attempts: Exploit:Script/SuspSignoutReqBody.A and two variants of Exploit:Script/ToolPaneAuthBypass. A separate Defender signature, Backdoor:MSIL/LeakFang.A, flags post-compromise activity involving stolen IIS secrets.
Before rotating IIS machine keys, hunt for the tools attackers use to harvest them. Rotate keys on a compromised box and the intruder simply steals the new ones.
CISA also wants SharePoint Central Administration blocked from the public internet, with any internet-facing SharePoint placed behind a Layer 7 reverse proxy, a filtering gateway that inspects web traffic and requires authentication before requests reach the server.
Does this affect ordinary users?
Not directly. This is an enterprise-server problem. But if your employer or local council runs an internal SharePoint portal, the IT team there needs to be patching this week. Staff using SharePoint should report unusual login prompts or file-sharing requests rather than clicking through them.
The real watch item here isn't the three known CVEs; it's the two unpatched systems that will still be running these versions in six months. Attackers know that too.
Report suspected intrusions to CISA's 24/7 operations centre at 1-844-729-2472.
