# Critical SharePoint Flaws Under Active Attack—Patch Deadline Looms for Federal Agencies
## The Threat
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning that threat actors are actively exploiting three critical vulnerabilities in on-premises Microsoft SharePoint Server instances. The three flaws—tracked as CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164—expose every supported version of SharePoint Server to complete compromise, from traditional on-premises deployments to Microsoft's newer Subscription Edition with its continuous update model.
According to CISA's advisory, attackers are weaponizing these vulnerabilities in a multi-stage attack chain: bypassing authentication controls, achieving unauthenticated remote code execution (RCE), and then conducting post-exploitation operations to steal Internet Information Services (IIS) machine keys and establish persistence through malware deployment. The stolen keys represent a particularly severe risk, as they can be leveraged for lateral movement across the broader infrastructure and for forging authentication tokens to other systems.
The threat is not theoretical. Security watchdog Shadowserver currently tracks nearly 10,000 Internet-exposed SharePoint Server instances globally, with over 800 confirmed to be unpatched against CVE-2026-32201 and CVE-2026-45659. Federal agencies face a hard deadline: July 17, 2026, to patch affected systems or discontinue them under CISA's Binding Operational Directive (BOD) 26-04. This marks the sixth time since November 2021 that CISA has flagged a SharePoint vulnerability for emergency patching, and significantly, seven of the eleven SharePoint flaws disclosed in that period have already been exploited in ransomware campaigns.
## Severity and Impact
| CVE ID | CVSS Score | Attack Vector | Attack Complexity | Authentication Required | Impact |
|---|---|---|---|---|---|
| CVE-2026-32201 | 8.8 | Network | Low | None | Remote Code Execution |
| CVE-2026-45659 | 8.6 | Network | Low | None | Authentication Bypass + RCE |
| CVE-2026-56164 | 8.9 | Network | Low | None | Remote Code Execution |
| CVE-2026-55040 | 7.5 | Network | Low | None | Elevation of Privilege |
| CVE-2026-58644 | 7.2 | Network | Low | None | Information Disclosure |
*Note: CVSS scores based on active exploitation reports and CISA severity classifications. Verify exact scores via NVD and official vendor advisories.*
## Affected Products
Actively Exploited:
Patched but Not Yet Exploited in the Wild:
Note: All publicly supported on-premises SharePoint Server versions are affected by at least one of the five vulnerabilities listed above.
## Mitigations
Immediate Actions:
1. Apply patches immediately. Microsoft released security updates on July 15, 2026. Download and deploy them without delay, and verify successful installation on all affected servers.
2. Reduce patching cycles. Organizations running Subscription Edition should accelerate their update cadence to mitigate the window of exposure.
3. Enable AMSI integration. Activate Windows Antimalware Scan Interface (AMSI) for SharePoint web applications to catch malicious scripts and payloads.
4. Deploy Microsoft Defender Antivirus. Use MDAV detection signatures to identify and remediate compromised systems.
Detection and Response:
Architectural Hardening:
## References
---
## HackWire Analysis
SharePoint has become a recurring weak point in Microsoft's enterprise portfolio—and not by accident. Since November 2021, CISA has tracked 11 SharePoint vulnerabilities, seven of which landed in ransomware toolkits. This isn't a story about isolated bugs; it's a pattern of threat actors systematically mapping on-premises SharePoint deployment as a reliable entry vector.
The convergence of three factors makes this particular wave especially dangerous. First, Internet exposure is still pandemic—Shadowserver's count of 10,000 publicly accessible instances suggests that despite years of warnings, organizations either don't realize they're exposed or believe they can't reduce exposure due to hybrid work models. Second, the Subscription Edition's continuous update cycle means patches arrive faster, but security teams struggle to keep pace. Third, IIS key theft is a high-value outcome: those keys don't just unlock SharePoint; they unlock everything the compromised server can authenticate to, turning one breach into a multi-system compromise.
The July 17 federal deadline is a forcing function, but it also highlights the two-tier reality of security: government agencies now have non-negotiable timelines, while the private sector still operates in a world where "we'll patch next month" is considered acceptable. For organizations running Internet-facing SharePoint, that luxury evaporates on July 17. For everyone else, the message is clear: either segment these systems behind reverse proxies and restrict access, or accept the risk of ransomware deployment driven by automated scanners picking targets off Shadowserver's public list.
The hardening recommendations CISA lists—reverse proxies, network segmentation, enhanced logging—are not new. They've been standard guidance for years. The fact that they need to be repeated suggests that either organizations don't implement them, or they deprioritize them until an active threat forces their hand. This advisory should be that forcing hand.
— HackWire Editorial
## Related Coverage