CISA Warns of Active Attacks Exploiting Microsoft SharePoint Server Vulnerabilities
CISA has updated its security guidance after confirming that attackers are actively exploiting multiple vulnerabilities in Microsoft SharePoint Server. The attacks are focused on on-premises SharePoint deployments, including SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.
According to the latest warnings, threat actors are using these flaws to gain elevated access, execute remote code, and steal sensitive cryptographic secrets from affected servers. The activity is especially concerning because successful exploitation can allow attackers to maintain access even after patches are installed, if organizations do not complete a full compromise assessment and key rotation process.
Several SharePoint vulnerabilities added to CISA’s exploited flaws catalog
CISA has added multiple Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities catalog this year, signaling that attackers are using them in real-world campaigns. The listed flaws include CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-50522.
CVE-2026-50522 was added after active exploitation followed the release of public proof-of-concept code, increasing the risk for organizations that had not yet patched or investigated their SharePoint environments.
Another major issue, CVE-2026-56164, is an unauthenticated privilege escalation vulnerability. Microsoft addressed it in the July 2026 Patch Tuesday security updates.
A separate vulnerability, CVE-2026-55040, has also drawn attention. This authentication bypass flaw carries a CVSS score of 9.1 and stems from weak authentication protections. It does not require prior access or user interaction, meaning an attacker could potentially impersonate a SharePoint site user or administrator. However, at the time of writing, this flaw has not been confirmed as actively exploited and has not been added to CISA’s exploited vulnerabilities catalog.
How attackers are exploiting SharePoint servers
Once attackers gain initial access to a vulnerable SharePoint server, they can chain additional flaws to expand control. Deserialization vulnerabilities, including CVE-2026-58644 and CVE-2026-50522, may allow attackers to execute arbitrary code with elevated permissions.
One of the most dangerous goals in these campaigns is the theft of Internet Information Services machine keys. These IIS machine keys are used by SharePoint to validate and decrypt ASP.NET ViewState data.
If attackers obtain these keys, they can forge trusted requests, bypass security checks, and regain administrative access even after the server has been updated. This gives intruders a powerful way to persist inside the environment, deploy webshells, and continue operating long after standard patching has been completed.
Why patching alone may not fix the problem
CISA and security researchers are warning administrators that installing Microsoft’s security updates is essential, but it may not be enough if a server has already been compromised.
If attackers have stolen IIS machine keys before patches are applied, they may still be able to return. Likewise, rotating the machine keys without first checking for compromise can fail if hidden scripts or malware remain on the server. In that case, newly generated keys could be stolen again almost immediately.
This makes incident response and forensic review a critical step. Organizations should not assume that a patched SharePoint server is automatically clean.
Recommended actions for SharePoint administrators
Organizations running on-premises Microsoft SharePoint Server should act quickly to reduce risk. Administrators should apply all relevant Microsoft security updates, but they should also perform a thorough investigation across their SharePoint farms before rotating IIS machine keys.
Security teams should search for forensic artifacts, webshells, suspicious scripts, unusual authentication activity, and signs of privilege escalation. Only after confirming that the environment is free of attacker-controlled tools should administrators rotate machine keys.
CISA also recommends enabling full-mode Antimalware Scan Interface request inspection where available. This can help detect and block malicious requests targeting SharePoint.
Organizations should also limit direct internet exposure for SharePoint servers whenever possible. Administrative interfaces should be placed behind authenticated reverse proxies or other strong access controls to reduce the chance of exploitation.
The key takeaway
The latest SharePoint attacks show why vulnerability management must go beyond simple patching. When attackers steal cryptographic secrets such as IIS machine keys, they can create long-term persistence and bypass normal defenses.
For organizations using SharePoint Server 2016, 2019, or Subscription Edition, the priority is clear: patch immediately, investigate thoroughly, rotate keys only after confirming the system is clean, and harden access to public-facing SharePoint infrastructure.
