CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities

1. Executive summary

CISA has confirmed active in-the-wild exploitation of four Microsoft SharePoint Server vulnerabilities — CVE-2026-32201 (CVSS 6.5 MEDIUM), CVE-2026-45659 (CVSS 8.8 HIGH), CVE-2026-56164 (CVSS 5.3 MEDIUM), and CVE-2026-58644 (CVSS 9.8 CRITICAL) — all listed in the CISA KEV catalog. Threat actors are chaining CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 to gain initial access to on-premises SharePoint deployments, extract IIS machine keys, establish persistence via deserialization techniques, and deploy malware. A fifth critical vulnerability, CVE-2026-55040 (CVSS 9.1 CRITICAL), is not yet exploited but carries an "Exploitation More Likely" assessment from Microsoft. EMEA financial services running internet-exposed, on-premises SharePoint Server (Subscription Edition, 2019, 2016) face immediate risk of unauthenticated intrusion, credential theft, and persistent compromise.

2. Regulatory framing

3. Technical analysis & attack chain

Prioritised triage table

Attack chain (confirmed active exploitation)

1. Initial access (CVE-2026-32201): An unauthenticated remote attacker exploits the spoofing vulnerability (CWE-20, improper input validation) over the network without user interaction to gain entry to the on-premises SharePoint Server instance.
2. Privilege escalation (CVE-2026-56164): The unauthenticated attacker exploits the elevation of privilege vulnerability (CWE-306, missing authentication for critical function) to elevate privileges on the SharePoint Server.
3. Remote code execution (CVE-2026-45659): Using obtained access, the authenticated attacker (requiring only Site Member permissions) exploits the deserialization of untrusted data vulnerability (CWE-502) to execute arbitrary code on the server. Microsoft originally rated exploitation as "Less Likely"; CISA confirmed active exploitation on July 1, 2026.
4. Credential theft: Post-exploitation, attackers extract IIS machine keys from the compromised server. Stolen machine keys can be used to forge requests, enabling further exploitation of the server.
5. Persistence: Attackers leverage deserialization techniques to establish persistence on the SharePoint Server.
6. Malware deployment: Attackers deploy malware (specific families not identified in source material).

CVE-2026-58644 (CVSS 9.8, confirmed exploited July 15) is a separate RCE vector requiring authenticated access with at least Site Owner permissions, exploited via deserialization of untrusted data.

Attribution caveat: As of July 16, 2026, neither CISA nor Microsoft has attributed the active exploitation of any of these vulnerabilities to specific threat actors or groups. Attribution is unconfirmed. Microsoft previously attributed 2025 "ToolShell" SharePoint exploitation to Chinese nation-state crews, but no such attribution exists for the current 2026 activity.

Historical context: CISA's KEV catalog contains 12 SharePoint-related entries. Seven are known to be used in ransomware campaigns (CVE-2025-49706, CVE-2025-49704, CVE-2025-53770, CVE-2024-38094, CVE-2023-24955, CVE-2023-29357, CVE-2019-0604). The current 2026 exploitation activity has not been linked to ransomware; "Known ransomware campaign use" is listed as "Unknown" for all current KEV entries.

4. Mitigation & containment

P1 — Within 24 hours

• Patch all internet-facing SharePoint Server instances to the fixed builds listed below. Prioritise CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644 (all KEV-listed, actively exploited).

• Isolate or remove internet exposure: CISA advises against direct internet exposure of SharePoint Servers. Move SharePoint behind VPN/zero-trust access gateways immediately. Block external access to SharePoint Central Administration.
• Enable AMSI integration: Enable Antimalware Scan Interface (AMSI) integration for SharePoint and IIS worker processes. Set Request Body Scan mode to Full to allow detection of malicious POST payloads.
• Threat hunt before key rotation: CISA explicitly warns that rotating IIS machine keys alone is NOT a complete remediation step without first removing any key-harvesting artifacts. Hunt for webshells, suspicious SharePoint worker-process activity, anomalous requests, and machine-key access activity before rotating keys.

P2 — Within 72 hours

• Patch all internal SharePoint Server instances (Subscription Edition, 2019, 2016) to the fixed builds above, including CVE-2026-55040 (not yet exploited but rated "Exploitation More Likely").
• Deploy detection signatures: Ensure Microsoft Defender Antivirus (MDAV) and AMSI signatures are current. Verify the following signatures are active:
• Exploit:Script/SuspSignoutReqBody.A (AMSI — request body scanning; Subscription Edition only)
• Exploit:Script/ToolPaneAuthBypass.A (AMSI — request header scanning; 2016, 2019, SE)
• Exploit:Script/ToolPaneAuthBypass.C (AMSI — RCE coverage; 2016, 2019, SE)
• Backdoor:MSIL/LeakFang.A!dha (MDAV — post-exploitation IIS machine key access)
• Review historical SharePoint KEV patch status: Verify remediation of the 12 historical SharePoint KEV entries, particularly the seven linked to ransomware campaigns.

P3 — Within 7 days

• Implement robust, tailored logging on all SharePoint Servers to detect potential exploit attempts, focusing on anomalous request patterns, authentication bypass attempts, and deserialization activity.
• Restrict SharePoint permissions: Review and tighten Site Member and Site Owner role assignments to limit the pool of authenticated users who could exploit CVE-2026-45659 and CVE-2026-58644.
• Validate external attack surface: Use attack surface management tooling to identify any unauthorised or forgotten internet-facing SharePoint deployments.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, file hashes, URLs) are available in the source material. CISA and Microsoft have published detection signatures and described observable behaviours instead.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

The source material provides AMSI and MDAV signature names (detection product identifiers) but no threat artefacts (strings, file paths, mutex names, command-line flags, registry keys, or hardcoded values) that would appear in the malicious files, commands, or traffic themselves. The signature names are vendor detection labels, not threat artefacts, and cannot be used to build functional YARA or Sigma rules.

CVE assessment

10 referenced CVEs — 9 actively exploited (CISA KEV), 4 critical (CVSS ≥ 9.0)

7. Sources

• Tenable Research Special Operations — "CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities" — https://www.tenable.com/blog/cve-2026-32201-cve-2026-45659-cve-2026-56164-faq-sharepoint-server-exploitation — 2026-07-16
• The Register Security — "CISA sounds alarm over trio of exploited SharePoint flaws" — https://www.theregister.com/security/2026/07/15/cisa-sounds-alarm-over-trio-of-exploited-sharepoint-flaws/5271814 — 2026-07-15
• The Hacker News — "SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation" — https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html — 2026-07
• SecurityWeek — "CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability" — https://www.securityweek.com/cisa-warns-of-actively-exploited-microsoft-sharepoint-vulnerability/ — 2026-07
• The Register Security — "Microsoft said exploitation was 'less likely' ... but CISA just added SharePoint RCE to KEV list" — https://www.theregister.com/security/2026/07/02/microsoft-said-exploitation-was-less-likely-but-cisa-just-added-sharepoint-rce-to-kev-list/5265886 — 2026-07-02
• NVD / CISA KEV — CVE-2026-45659 — https://nvd.nist.gov/vuln/detail/CVE-2026-45659
• NVD / CISA KEV — CVE-2026-58644 — https://nvd.nist.gov/vuln/detail/CVE-2026-58644

8. Adverse Trace position

This is a high-severity active exploitation event targeting on-premises SharePoint Server — a common collaboration and document management platform in EMEA financial services. Four KEV-listed vulnerabilities are confirmed exploited in the wild, with a documented attack chain demonstrating initial access, privilege escalation, RCE, IIS machine key theft, persistence, and malware deployment. The attack chain requires no user interaction for initial entry (via CVE-2026-32201 and CVE-2026-56164), lowering the barrier to compromise. Attribution is unconfirmed; no threat actor or group has been named by CISA or Microsoft. No public proof-of-concept exists as of July 16, but the KEV listing confirms weaponisation regardless. Clients running internet-facing on-premises SharePoint Server (Subscription Edition, 2019, or 2016) should treat this as a P1 incident: patch immediately, remove internet exposure, enable AMSI with Full request body scanning, and conduct threat hunting for IIS machine key access and webshells before rotating keys. We will monitor for attribution, IOCs, and any ransomware linkage, and will update this advisory if the threat landscape shifts.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.