On July 14, Microsoft disclosed five vulnerabilities affecting on-premises SharePoint Server, and within two days, attackers were exploiting four of them in the wild. 

CISA confirmed active exploitation of CVE-2026-32201, CVE-2026-45659 and CVE-2026-56164 on the same day that Microsoft shipped patches, and Microsoft confirmed exploitation of a fourth (CVE-2026-58644) one day later. 

A fifth flaw, CVE-2026-55040, has not been observed to be exploited yet, but Microsoft rates it "Exploitation More Likely." For any organization still running SharePoint Server 2016, 2019 or Subscription Edition on-premises, this is not a routine patch cycle. It is an active intrusion set with a tight window to close.

The Exploitation Chain

CISA's alert states that attackers have combined three of the four actively exploited bugs to gain entry and then pursue post-exploitation objectives, a sequence corroborated by Tenable's research team. Here’s the chain:

• CVE-2026-32201 is an unauthenticated spoofing flaw from improper input validation (CVSS 6.5) that provides an initial foothold. 
• CVE-2026-45659 is a deserialization-of-untrusted-data RCE (CVSS 8.8) that an authenticated session can trigger. 
• CVE-2026-56164 is an elevation-of-privilege bug tied to a missing authentication check, exploitable remotely without credentials. Its scoring is split, with Microsoft rating it 5.3 (moderate) and NVD independently scoring it 9.8 (critical). This a discrepancy worth flagging as it shows that risk-scoring tools pulling from different feeds will disagree on this vulnerability. Regardless of which score any given tool surfaces, the practical effect is the same — no credentials and no user interaction are required.

Used together, these three bugs can get an outside party to code execution on the SharePoint application server. CVE-2026-58644, the newest addition to KEV, is a separate deserialization RCE (CVSS 9.8) exploitable by an attacker who already holds Site Owner permissions. This provides a second path to the same outcome for actors who have established a foothold through other means.

Once inside, the observed post-exploitation activity centers on IIS machine key theft. SharePoint, like other ASP.NET applications, uses machine keys to validate and encrypt ViewState. An attacker who extracts these keys can forge authenticated requests and deserialize arbitrary payloads on the server going forward, independent of whether the original entry vulnerability gets patched. 

CISA's advisory is explicit that rotating the machine keys without first removing key-harvesting artifacts is not a complete remediation step. 

If a webshell or scheduled task survives the rotation, the attacker regains persistence the next time keys are exposed or simply pivots to whatever access the shell already provides. This mirrors the pattern from last July's ToolShell campaign (CVE-2025-53770 and CVE-2025-53771), which also targeted on-prem SharePoint deserialization and was later tied to ransomware deployment. 

Tenable's research team counts 12 SharePoint-related entries in the KEV catalog to date, seven of them tied to known ransomware use, underscoring that this is a platform with an established track record as an initial access vector.

Detection and Mitigation

Patch first. 

Microsoft has published fixed builds for all five CVEs across SharePoint Enterprise Server 2016, Server 2019 and Subscription Edition, with specific build numbers reproduced in Tenable's FAQ. Federal agencies were given until July 17 to remediate CVE-2026-56164 under Binding Operational Directive 26-04, which is a reasonable benchmark for anyone else's urgency.

Beyond patching, enable AMSI integration on SharePoint and IIS worker processes and set Request Body Scan mode to Full, which is what allows Defender to catch malicious POST payloads rather than just header-based indicators. Microsoft and CISA have released four detection signatures tied to this activity: 

• Exploit:Script/SuspSignoutReqBody.A and two variants of Exploit:Script/ToolPaneAuthBypass for the exploitation attempts, and 
• Backdoor:MSIL/LeakFang.A!dha for post-exploitation machine key access. 

None of these require a public IOC list to act on, since no domains or IPs have been broadly disclosed as of this writing.

If a server shows any of these signatures, or if it has been internet-facing and unpatched at any point since July 14, treat the machine keys as compromised. Remove webshells and scheduled persistence first, rotate the keys second and then patch. Doing it in the reverse order leaves a gap where a forged request can simply mint new access. 

For the longer term, minimize direct internet exposure of SharePoint servers, restrict access to Central Administration, and put a Layer 7 reverse proxy in front of anything that has to stay reachable from outside.

No specific threat actor has been publicly attributed to this wave as of July 20, and no public proof-of-concept exists for any of the five CVEs, which is a narrower window than security teams got with ToolShell last year. That window closes fast once a working exploit leaks. If SharePoint Server sits anywhere in the environment, this is worth checking today rather than at the next patch cycle.

Sources

1. CISA, "CISA Urges SharePoint Hardening After New Exploitations," July 14, 2026. cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations
2. The Hacker News, "CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV," July 2026. thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html
3. Tenable Research Special Operations, "CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities," July 16, 2026. tenable.com/blog/cve-2026-32201-cve-2026-45659-cve-2026-56164-faq-sharepoint-server-exploitation
4. Rapid7, "CVE-2026-58644: Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the Wild," July 17, 2026. rapid7.com/blog/post/etr-cve-2026-58644-microsoft-sharepoint-server-unauthenticated-remote-code-execution-vulnerability-exploited-in-the-wild
5. Microsoft Security Response Center, security advisory for CVE-2026-58644 and related SharePoint Server CVEs, July 14, 2026. msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644
6. NVD, CVE-2026-56164 detail record. nvd.nist.gov/vuln/detail/CVE-2026-56164

Published By: Daniel Parker, VP of Ethical Hacking, NetWorks Group

Publish Date: July 23, 2026