Recent reports have highlighted active exploitation of critical vulnerabilities in Microsoft SharePoint Server, leading to remote code execution (RCE), deployment of persistent web shells, and theft of cryptographic keys. These attacks primarily target on-premises SharePoint deployments, posing significant risks such as data breaches, network compromise, and prolonged unauthorized access.
The affected versions include SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Attackers are leveraging a combination of authentication bypasses, unsafe data processing, and input-validation flaws to transform internet-facing collaboration servers into gateways for broader network infiltration.
Details of the Exploited Vulnerabilities
Among the vulnerabilities being actively exploited are CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164. These have been added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities catalog. Specifically, CVE-2026-45659 allows site members to execute code remotely, while CVE-2026-56164 enables unauthenticated attackers to access critical functions without proper authentication.
Upon successful exploitation, attackers can install web shells on the SharePoint server, granting them the ability to execute commands, upload files, and maintain persistent access. This method mirrors previous web shell attacks against Internet Information Services (IIS), where compromised web servers serve as stealthy footholds within organizations.
Implications and Recommendations
A particularly alarming aspect of these attacks is the theft of ASP.NET machineKey values stored in SharePoint configuration files. These keys are essential for protecting application data, and their compromise allows attackers to generate trusted-looking ViewState data or authentication tokens, facilitating continued access even after initial vulnerabilities are patched.
Organizations are strongly advised to promptly apply Microsoft’s July 2026 security updates across all SharePoint servers to mitigate these risks. Additionally, unpatched, internet-exposed SharePoint servers should be prioritized for incident response and thorough threat hunting to identify and neutralize potential compromises.
These developments underscore the critical importance of maintaining up-to-date security measures and conducting regular vulnerability assessments, especially for internet-facing systems. As attackers continue to exploit known vulnerabilities, proactive patch management and vigilant monitoring are essential to safeguard organizational assets and data.
