CISA Adds Six SharePoint Server RCE Bugs to KEV Catalog
The accelerating cadence (one in April, five more between July and August, all affecting on-prem Subscription Edition, 2019, and 2016) points to a methodical campaign, not opportunistic scanning.
TL;DR
CISA added six SharePoint Server RCE vulnerabilities to its Known Exploited Vulnerabilities catalog between April 14 and August 18, 2026, confirming active exploitation against all supported on-premises versions. The post-exploitation playbook (IIS machine-key theft, deserialization, persistence, malware deployment) mirrors the 2025 ToolShell campaign but with six entry points instead of two. CISA's hardening guidance calls for removing SharePoint from direct internet exposure, patching, and enabling AMSI in Full Mode.
The six vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522, and CVE-2026-55040) span a four-month window that accelerated sharply in July. CISA added the first on April 14, the second on July 1, and then four more between July 14 and August 18. All six affect SharePoint Server Subscription Edition, 2019, and 2016, and all involve remote code execution. The post-exploitation activity follows a familiar shape: IIS machine-key theft, deserialization, and malware deployment. CISA's 2025 alert documented the same playbook against SharePoint: RCE leading to key theft and malware deployment that escalated within weeks.
The difference this time is breadth. Six CVEs means six independently weaponized entry points into the same target. An organization that patched for one may still be exposed through another. That's not typical vulnerability churn; it's an attacker working through the attack surface systematically.
CISA's hardening guidance doesn't leave much room for interpretation. Don't expose SharePoint directly to the internet. If you must, put a Layer 7 reverse proxy in front that enforces authentication and filters inbound requests. Apply patches and verify installation; shorten patching cycles. Enable AMSI integration for each SharePoint web application in Full Mode. CISA provides specific detection signatures that defenders can deploy immediately, including AMSI:Exploit/Script/SuspSignoutReqBody.A and AMSI:Exploit/Script/ToolPaneAuthBypass.A for request scanning, plus MDAV:Backdoor:MSIL/LeakFang.A!dha for post-exploitation detection.
One thing the alert doesn't say: whether Microsoft has published patches for all six CVEs across all three supported versions. CISA's instruction to apply "the latest patches and security updates from Microsoft" implies availability but doesn't confirm it version by version. For a SharePoint 2016 shop, that distinction is operational. If the patch exists for Subscription Edition but not 2016, the mitigation path isn't patching, it's the network-layer controls and detection signatures CISA describes. Until the CVE-to-update mapping is public, organizations running older versions should assume they're operating on hardening guidance alone.
Published ·Deep Fathom