# CISA Warns of Critical SharePoint Exploitation Campaign: Immediate Patching Required


The US Cybersecurity and Infrastructure Security Agency (CISA) has escalated its alert regarding multiple actively exploited vulnerabilities in Microsoft SharePoint, demanding that federal agencies and organizations deploy patches within days. The warning comes as attackers continue to leverage zero-day flaws in one of the world's most widely deployed enterprise collaboration platforms, creating an urgent security imperative across government and private sector networks.


## The Immediate Threat


CISA's Tuesday alert centered on CVE-2026-56164, a critical privilege escalation vulnerability in SharePoint that can be exploited remotely without any authentication. The flaw was patched as part of Microsoft's July 2026 Patch Tuesday cycle, but exploitation has already begun in active attacks. Under CISA's Binding Operational Directive (BOD 26-04), federal agencies face a strict three-day deadline to deploy patches for this vulnerability.


The severity of CVE-2026-56164 is compounded by its authentication-bypass nature—attackers need not compromise credentials or maintain persistent access to launch an attack. This characteristic makes it particularly attractive to threat actors seeking rapid network compromise for reconnaissance, lateral movement, or initial payload deployment.


Alongside CVE-2026-56164, Microsoft's July updates also addressed CVE-2026-55040 and CVE-2026-58644, both carrying critical severity ratings. CVE-2026-55040 enables security feature bypass, while CVE-2026-58644 permits arbitrary code execution. Though not yet reported as exploited in the wild, both pose significant risk if left unpatched.


## Background and Context


This is not the first time SharePoint has been targeted at scale. Two additional vulnerabilities underscore a troubling pattern:


  • CVE-2026-32201 (Spoofing): Exploited as a zero-day in April 2026, this flaw demonstrates that SharePoint zero-days have become a reliable attack vector for sophisticated threat actors.
  • CVE-2026-45659 (Code Execution): Patched via out-of-band update in May 2026 and added to CISA's Known Exploited Vulnerabilities (KEV) catalog in early July, this vulnerability illustrates the speed at which SharePoint flaws transition from zero-day to widespread exploitation.

    • The escalating frequency of SharePoint exploits reflects the platform's dual role as both a productivity tool and a lucrative attack surface. SharePoint's integration with Active Directory, file repositories, and internal communications makes it a high-value target for attackers seeking both lateral movement and data exfiltration.


    All supported on-premises versions are affected: SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Organizations running hybrid or cloud-based SharePoint instances (Microsoft 365) should verify whether they have on-premises deployments exposed to attack.


    ## Technical Details and Attack Methods


    CISA's advisory reveals sophisticated post-exploitation tradecraft that extends beyond simple code execution:


    Initial Compromise:

    Attackers exploit CVE-2026-56164 or similar flaws to gain unauthenticated remote code execution (RCE) on SharePoint web servers. The absence of authentication requirements means attackers can attack from the internet without first establishing credentials or user access.


    Post-Exploitation Techniques:

    Once inside, threat actors employ tactics including:


  • IIS Machine Key Theft: Stealing Internet Information Services (IIS) machine keys enables attackers to forge authentication tokens, facilitating persistence and credential bypass across connected services.
  • Deserialization Attacks: Exploiting .NET deserialization vulnerabilities to execute arbitrary code and bypass security controls.
  • Lateral Movement: Using compromised SharePoint access to pivot to domain controllers, file servers, and other sensitive systems.
  • Malware Deployment: Installing web shells, backdoors, or C2 implants for long-term persistence and command execution.

    • This escalation from initial access to domain compromise typically occurs within hours if undetected. Organizations without robust monitoring are unlikely to discover breaches until well after sensitive data has been exfiltrated.


    ## Scope and Affected Systems


    | Vulnerability | CVE ID | Severity | Type | Patch Status | Exploitation Status |

    |---|---|---|---|---|---|

    | Privilege Escalation | CVE-2026-56164 | Critical | Remote Unauthenticated | July 2026 Patch Tuesday | Active |

    | Security Bypass | CVE-2026-55040 | Critical | Remote Unauthenticated | July 2026 Patch Tuesday | Unconfirmed |

    | Code Execution | CVE-2026-58644 | Critical | Remote Unauthenticated | July 2026 Patch Tuesday | Unconfirmed |

    | Spoofing | CVE-2026-32201 | High | Remote Unauthenticated | April 2026 | Active (Zero-Day) |

    | Code Execution | CVE-2026-45659 | Critical | Remote Unauthenticated | May 2026 (Out-of-Band) | Active |


    Organizations running SharePoint Server on-premises—whether as a primary collaboration platform or legacy deployment—should assume their systems are actively being scanned and probed for vulnerabilities.


    ## Implications for Organizations


    Government and Federal Agencies:

    The three-day patching requirement under BOD 26-04 creates a compliance obligation with auditing implications. Federal agencies that fail to patch within the deadline face potential oversight and remediation mandates.


    Enterprise Organizations:

    For private sector organizations, SharePoint vulnerabilities represent both immediate compromise risk and regulatory exposure. Healthcare organizations, financial institutions, and critical infrastructure operators relying on SharePoint must prioritize patching to maintain compliance with security frameworks (HIPAA, PCI-DSS, NIST Cybersecurity Framework).


    Hybrid and Cloud Considerations:

    Organizations using Microsoft 365 (cloud-based SharePoint) are not directly impacted by on-premises vulnerabilities. However, organizations with hybrid deployments—combining cloud and on-premises SharePoint—must ensure both environments are hardened.


    ## Recommended Actions


    CISA and Microsoft recommend a multi-layered defense strategy:


    Immediate (This Week):

  • Apply patches: Deploy Microsoft's July 2026 updates to all SharePoint Server instances within your environment
  • Identify deployments: Conduct a network asset inventory to locate all SharePoint servers, including legacy or forgotten instances
  • Restrict internet exposure: Verify that SharePoint servers are not directly accessible from the internet; access should route through WAF, VPN, or reverse proxy

    • Short-Term (This Month):

  • Rotate IIS machine keys: Replace all IIS machine keys across SharePoint farms to invalidate any stolen credentials
  • Enhanced logging: Enable detailed logging for SharePoint authentication, file access, and administrative actions
  • Access controls: Restrict SharePoint administration interfaces to dedicated management networks; implement multi-factor authentication (MFA) for all administrative accounts
  • Threat hunting: Search event logs and network telemetry for indicators of compromise: unusual deserialization activities, IIS key access, suspicious IIS web app pools, and unexpected PowerShell executions

    • Long-Term:

  • Security product coverage: Ensure endpoint detection and response (EDR), web application firewalls (WAF), and intrusion detection systems (IDS) actively monitor all SharePoint web applications
  • Segmentation: Isolate SharePoint servers from user workstations and sensitive systems using network segmentation
  • Patch cadence: Adopt automated patch management to reduce time-to-patch and eliminate manual deployment delays

    • ---


    ## HackWire Analysis


    This alert represents a critical inflection point for organizations still operating on-premises SharePoint. The convergence of multiple zero-days patched over three months—combined with active exploitation—signals that SharePoint is now a *prioritized target* for nation-state and financially-motivated threat actors alike.


    What makes this campaign particularly alarming is the post-exploitation sophistication. Stealing IIS machine keys is not opportunistic malware behavior—it's targeted tradecraft aimed at establishing durable persistence and lateral movement. This suggests the attackers behind these exploits have studied SharePoint internals deeply and are operating with specific objectives (data theft, espionage, ransomware staging). The use of deserialization techniques indicates attackers are not just achieving RCE; they're weaponizing it to bypass additional security layers.


    Organizations should not view this as a traditional "patch Tuesday" routine. The three-day federal mandate reflects CISA's assessment that active exploitation is occurring *right now*. Private sector organizations lacking automated patch deployment face a significant risk window. Those with segmentation failures—where SharePoint has internet-facing exposure or direct network routes to domain controllers—are in immediate danger of compromise.


    The broader pattern is troubling: SharePoint zero-days in April, May, and now July suggest either (1) a coordinated disclosure by a bug bounty platform, (2) independent discovery of a common class of vulnerability, or (3) deliberate holding and delayed patching by a sophisticated threat actor testing exploitation methods before broader deployment. Regardless of origin, organizations that delay patching beyond this week should expect breach activity.


    For organizations unable to patch immediately due to operational constraints, immediate compensating controls are non-negotiable: network segmentation, WAF deployment, and enhanced logging will not prevent breach, but they will contain blast radius and improve detection speed.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)