CISA links three SharePoint CVEs to active exploitation

CISA’s July 14 alert turns the SharePoint issue from a CVE-management exercise into an intrusion-response problem. The agency says three vulnerabilities, CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, are under active exploitation against all supported on-premises SharePoint Server versions: Subscription Edition, 2019, and 2016. The observed activity includes remote code execution, theft of Internet Information Services machine keys, deserialization techniques for persistence, and malware deployment.

That matters because the recommended work is broader than installing a patch and closing the ticket. CISA tells organizations to apply Microsoft’s latest updates, verify installation, and shorten patching cycles where possible. It also points operators to Antimalware Scan Interface integration for each SharePoint web application, including Full Mode request-body scanning where feasible, and to Microsoft Defender Antivirus and AMSI detections for suspicious sign-out request bodies, ToolPane authentication bypass activity, RCE coverage, and post-exploitation activity involving IIS-protected secrets.

The ugly operational detail is the machine-key problem. CISA specifically warns organizations to hunt for and remediate intrusion artifacts, including machine-key harvesters, before rotating IIS machine keys. Rotating keys while leaving the harvester in place is the security version of changing the locks while the burglar still has a couch upstairs. SharePoint teams should also review logs for anomalous requests, suspicious worker-process activity, webshells, and machine-key access, then restrict exposed services, block external access to Central Administration, and put internet-facing SharePoint behind a Layer 7 reverse proxy or equivalent authenticated application-layer control when exposure is necessary.

CISA also noted two newly disclosed SharePoint CVEs, CVE-2026-55040 and CVE-2026-58644, that are not yet known to have been exploited but that Microsoft identified as risky if left unpatched. The three exploited CVEs are now in CISA’s Known Exploited Vulnerabilities Catalog, with CVE-2026-32201 added April 14, CVE-2026-45659 added July 1, and CVE-2026-56164 added July 14. For federal and government-adjacent operators, that means this is no longer a planned hardening item. Patch, verify AMSI coverage, hunt first, rotate after the hunt, and run incident response on positive detections.