US cybersecurity officials are telling every organization that still runs SharePoint on its own hardware to treat the platform as an active target. CISA's alert, updated as recently as July 28, now lists five separate vulnerabilities under active exploitation against on-premises SharePoint Server — and the agency has repeatedly added each one to its Known Exploited Vulnerabilities (KEV) catalog within days of a patch appearing.
The list reads like a year of Patch Tuesdays compressed into one warning. CVE-2026-32201, a spoofing flaw patched in April, went into the KEV catalog on April 14 after attackers used it as a zero-day. CVE-2026-45659, a code execution bug fixed through an out-of-band May update, followed on July 1. CVE-2026-56164, a privilege escalation issue that can be triggered remotely without authentication, landed in the catalog on July 14. CVE-2026-58644, a critical deserialization hole with a CVSS score of 9.8, joined on July 16. The most recent addition, CVE-2026-50522 — another critical deserialization flaw — was cataloged on July 22.
What Attackers Do After They Get In
CISA's analysts describe the post-exploitation playbook in plain terms: attackers establish remote code execution, then steal Internet Information Services (IIS) machine keys and run deserialization techniques to keep a foothold and drop malware. The machine-key theft matters more than it sounds. Those keys let an attacker forge authentication tokens and application state that the server treats as legitimate — which means patching the original bug does not necessarily kick them out.
"Before rotating IIS machine keys, hunt for and remediate any intrusion artifacts, including machine-key harvesters, that could allow for the keys to be stolen again," the agency warns in the alert.
Security vendor ThreatLocker, which published its own analysis of the exploit chain, notes that the deserialization path runs through the SessionSecurityTokenHandler class in the Windows Identity Foundation token-processing framework. An authenticated attacker with at least Site Owner rights sends a crafted request, the server deserializes attacker-controlled objects, and a .NET gadget chain turns that into code running under the SharePoint process. From there, the practical impact ranges from webshells and credential theft to lateral movement across the farm.
Every Supported On-Premises Version Is Exposed
Microsoft's advisories cover all three supported on-premises lines: SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. The patched builds differ by version — Subscription Edition needed to reach 16.0.19725.20434, 2019 needed 16.0.10417.20175, and 2016 needed 16.0.5561.1001 — but the message is the same: install the July cumulative updates and verify they took.
The exploitation window is not hypothetical. The Hacker News reported that CVE-2026-58644 was weaponized as a zero-day before the July 14 Patch Tuesday fixes shipped, and Microsoft later revised its bulletin to confirm in-the-wild use. Federal Civilian Executive Branch agencies had until July 19 to apply that fix, per the KEV catalog's three-day rule.
TrueSec's threat summary walks through the four CVEs it tracked alongside CISA's guidance, and warns that the flaws "can be chained by attackers to gain unauthorized access and execute arbitrary code on affected systems." The spoofing bug, the privilege escalation hole, and the two deserialization flaws form a usable ladder: authentication bypass, elevation, then code execution.
How to Check for a Compromise
CISA published specific detection signatures tied to the campaign. With Antimalware Scan Interface (AMSI) integration enabled in Full Mode for request body scanning, administrators can look for Exploit:Script/SuspSignoutReqBody.A on Subscription Edition, Exploit:Script/ToolPaneAuthBypass.A for header scanning on all three versions, and Exploit:Script/ToolPaneAuthBypass.C for RCE coverage. Microsoft Defender Antivirus flags the post-exploitation stage as Backdoor:MSIL/LeakFang.A!dha, which the company describes as activity involving IIS-protected secrets.
For organizations that cannot confirm a clean state, the agency's hardening checklist is worth treating as a priority list: apply the latest patches and shorten patch cycles, verify AMSI is enabled for every SharePoint web application, hunt for machine-key harvesters before rotating keys, set up tailored logging, and stop exposing SharePoint to the internet unless it is genuinely required.
The Bigger Pattern: Server Software Is the Weak Point
The SharePoint push fits a pattern security teams have watched all year. On-premises collaboration and mail servers keep absorbing zero-days because they sit directly on the internet, run with high privileges, and store the kinds of credentials attackers want. CISA's KEV catalog now carries dozens of entries for Microsoft server products alone, and each new addition follows the same rhythm: exploit in the wild, emergency patch, catalog entry, three-day federal deadline.
The countermeasures are unglamorous but proven. Put SharePoint behind a Layer 7 reverse proxy that requires authentication, restrict farm and database communications, block external access to Central Administration, and treat the IIS machine keys as crown jewels rather than routine configuration. Microsoft's own security-hardening guidance covers the role-specific ports, services, and Web.config settings worth reviewing.
For the wider IT community, the lesson is blunt: if a server has been internet-facing since before April, assume it was probed. Run the AMSI checks, review logs for machine-key access, and rotate those keys only after confirming no harvester is still sitting in the farm. The patches close the door. The cleanup decides whether the intruder is actually gone.
SharePoint's run as the default corporate intranet made it a fixture in thousands of organizations. CISA's updated alert is a reminder that being a fixture also makes it a target — and that the window between "exploited" and "patched" keeps shrinking. For more on how similar flaws have been handled, see our Cybersecurity coverage and the earlier look at how Clop's exploitation of PTC Windchill unfolded.
What Teams Should Do This Week
Start with inventory. Find every SharePoint Server instance on the network, note which version line it runs — Subscription Edition, 2019, or 2016 — and compare the build number against the patched versions Microsoft published on July 14. Anything below 16.0.19725.20434 on Subscription Edition, 16.0.10417.20175 on 2019, or 16.0.5561.1001 on 2016 needs the cumulative update immediately, not at the next scheduled maintenance window.
Then check exposure. A server reachable from the internet without a reverse proxy in front is the scenario every one of these CVEs was designed for. CISA's guidance is direct about it: avoid direct internet exposure unless necessary, and when it is necessary, put the server behind a Layer 7 proxy that authenticates and inspects requests. Block external access to Central Administration entirely — that interface should be an internal management channel, not a public endpoint.
Finally, assume the worst until proven otherwise. Pull the IIS logs, look for requests that hit unusual worker-process activity or webshell indicators, and check whether any account touched the machine keys without a corresponding change ticket. The AMSI signatures listed above give defenders a concrete starting point, but they only catch what Microsoft has already seen. Custom logging around SharePoint worker processes and key access catches what the signatures miss.
None of this is glamorous work. It is the kind of maintenance that rarely makes a headline — until the alternative does. CISA's catalog entry for these flaws, and the July 28 update to its alert, suggest the campaign against on-premises SharePoint is not winding down. The defenders who treat that as a given, rather than a possibility, are the ones who keep their keys out of someone else's hands.