# Active SharePoint Server Exploitation Campaign Forces Emergency Hardening Push


## The Threat


Cyber threat actors are actively exploiting a cascading series of vulnerabilities in Microsoft's on-premises SharePoint Server infrastructure, spurring CISA to declare three CVEs as known-exploited vulnerabilities and issue urgent hardening guidance across federal and private sector organizations. The attack chain enables unauthenticated remote code execution (RCE) against all supported versions of SharePoint Server—including the latest Subscription Edition—with post-exploitation techniques designed to establish persistent access and exfiltrate sensitive credentials.


The vulnerability chain is particularly dangerous because it combines multiple attack vectors into a complete takeover pipeline. Once initial access is achieved through RCE, attackers leverage deserialization techniques and machine-key harvesting to bypass additional authentication layers, steal Internet Information Services (IIS) cryptographic material, and deploy secondary payloads for long-term persistence. This multi-stage approach significantly increases the attack surface and reduces the window for detection, as defenders must identify compromise across multiple forensic indicators.


The timing is critical: the oldest CVE in this chain (CVE-2026-32201) was added to CISA's Known Exploited Vulnerabilities catalog in mid-April 2026, but additional variants continued to be discovered and exploited through mid-July. This suggests an ongoing research-to-exploitation cycle where attackers are discovering new attack vectors faster than patches can be deployed across enterprise infrastructure. Organizations running older SharePoint versions face compounded risk if they've deprioritized patching cycles for on-premises deployments.


## Severity and Impact


| CVE ID | CVSS Score | Attack Vector | Requires Authentication | Attack Complexity | Impact |

|--------|-----------|----------------|------------------------|-------------------|---------|

| CVE-2026-32201 | High | Network | No | Low | Remote Code Execution |

| CVE-2026-45659 | High | Network | No | Low | Remote Code Execution |

| CVE-2026-56164 | High | Network | No | Low | Remote Code Execution |

| CVE-2026-55040 | High | Network | No | Low | Post-Exploitation Techniques |

| CVE-2026-58644 | High | Network | No | Low | Privilege Escalation |


Note: CISA's initial alert does not provide specific CVSS vector strings. Organizations should consult Microsoft's security advisories and the National Vulnerability Database for detailed technical specifications. The attack chain enables attackers to execute arbitrary code without valid credentials, harvest IIS machine keys for lateral movement, and deploy web shells or malware payloads for persistence.


## Affected Products


  • Microsoft SharePoint Server 2016 (all supported patches)
  • Microsoft SharePoint Server 2019 (all supported patches)
  • Microsoft SharePoint Server Subscription Edition (current releases)

    • All on-premises deployments using these versions are at risk. Organizations running SharePoint Online (cloud-hosted) are not directly affected by these on-premises vulnerabilities.


    ## Mitigations


    ### Immediate Actions (Priority 1)


  • Apply all available Microsoft security updates immediately for your SharePoint version. Verify installation completes successfully and test in non-production environments before production deployment.
  • Enable AMSI (Antimalware Scan Interface) integration for all SharePoint web applications. Follow Microsoft's official CISA-referenced guidance and configure Request Body Scan Mode to "Full Mode" where feasible to detect malicious payloads.
  • Deploy AMSI and Microsoft Defender Antivirus detection rules to alert on exploitation attempts:

    • - Exploit:Script/SuspSignoutReqBody.A (request body scanning; Subscription Edition)

    - Exploit:Script/ToolPaneAuthBypass.A (request header scanning; all versions)

    - Exploit:Script/ToolPaneAuthBypass.C (RCE coverage; all versions)

    - Backdoor:MSIL/LeakFang.A!dha (post-exploitation activity)


    ### Network and Access Controls (Priority 2)


  • Never expose SharePoint Server directly to the internet. If external access is required, place the server behind a Layer 7 reverse proxy or equivalent application-layer security control that enforces authentication and can inspect/filter requests.
  • Block external access to SharePoint Central Administration entirely. Restrict farm-to-farm and database communications to required systems only.
  • Review Microsoft's role-specific hardening guidance for port configuration, required services, and Web.config security settings.

    • ### Forensics and Hardening (Priority 3)


  • Hunt for and remediate exploitation artifacts including machine-key harvesting tools, webshells, and suspicious worker-process activity before rotating IIS machine keys.
  • Establish tailored logging mechanisms to detect anomalous SharePoint requests, privilege escalation attempts, and unauthorized key access. Review CISA's Best Practices for Event Logging and Threat Detection.
  • Rotate IIS machine keys only after confirming no intrusion artifacts remain, using Microsoft's guidance on ASP.NET view state security and key management.
  • Shorten patching cycles for SharePoint deployments to reduce the window during which zero-day variants can be exploited.

    • ## References


  • [CISA Alert: Exploitation of SharePoint Server Vulnerabilities](https://www.cisa.gov/news-events/alerts)
  • [Microsoft SharePoint Server Security Hardening Guidance](https://learn.microsoft.com/en-us/sharepoint/dev/general-development/sharepoint-security-hardening)
  • [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
  • [CISA Event Logging and Threat Detection Best Practices](https://www.cisa.gov/event-logging)
  • [Microsoft: Improved ASP.NET View State Security and Key Management](https://learn.microsoft.com/en-us/aspnet/web-forms/overview/moving-to-aspnet-20/asp-net-state-management)

    • ## HackWire Analysis


    This vulnerability chain underscores a broader vulnerability in how enterprises manage on-premises infrastructure in a cloud-first era. SharePoint Server deployments have been "modern but legacy"—technically supported by Microsoft, yet often running on older network segments with outdated perimeter security and irregular patching schedules. The fact that attackers discovered multiple RCE variants across four months suggests that many organizations lack the telemetry and logging visibility to detect compromise in real time.


    The emphasis on IIS machine-key harvesting is particularly revealing. Attackers aren't just seeking one-time code execution; they're extracting cryptographic material to bypass additional authentication controls and maintain access even after the initial exploit is patched. This post-exploitation strategy indicates a targeted, sophisticated campaign likely aimed at persistent espionage or lateral movement within enterprise environments, rather than opportunistic malware distribution.


    Organizations should treat this as a full infrastructure alert, not just a patch-and-close scenario. The presence of unpatched CVE-2026-55040 and CVE-2026-58644 (not yet publicly exploited but flagged by Microsoft as high-risk) means the attack surface is still expanding. This is a moment for enterprises to audit their SharePoint footprint, verify network isolation, and implement the full defense-in-depth hardening package CISA outlined—not just patching. For federal contractors and critical infrastructure operators, this alert carries additional weight: CISA typically escalates advisories to this level when active exploitation impacts government-connected networks.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)