Your On-Prem SharePoint Server Is Under Active Attack — Why Patching Alone Won’t Fix It
If your organization runs on-premises Microsoft SharePoint Server — Subscription Edition, SharePoint Server 2019, or SharePoint Enterprise Server 2016 — and it has been reachable from the internet at any point since April 2026, treat this as a live incident, not a routine patch cycle. Four vulnerabilities in this product line are being actively exploited right now, and attackers who got in before you patched can keep their access after you patch, because they steal a cryptographic key rather than relying on the bug itself. Applying the update is necessary. It is not sufficient. SharePoint Online (Microsoft 365) is not affected.
The vulnerabilities, in plain terms
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) — the federal agency responsible for tracking threats to critical infrastructure — has confirmed active exploitation of four flaws in on-premises SharePoint Server, added to its Known Exploited Vulnerabilities catalog (a public list of bugs attackers are using right now, not just theoretical risks) between April and July 2026:
- CVE-2026-32201 — an authentication spoofing flaw (severity 6.5 of 10), patched in April 2026.
- CVE-2026-45659 — a remote code execution flaw (severity 8.8 of 10), patched in May 2026. Exploitation requires an authenticated attacker who already holds at least Site Member permissions — a standard, non-elevated collaborator account, not an administrator credential — so this is not an open-door bug, but a low-privilege login is enough.
- CVE-2026-56164 — a privilege escalation flaw (severity 5.3 of 10), patched July 14, 2026. This one needs no account at all: a missing authentication check on an exposed endpoint lets a fully unauthenticated attacker grant themselves administrator rights directly.
- CVE-2026-58644 — a remote code execution flaw (severity 9.8 of 10), also patched July 14, 2026, and the most dangerous of the four. It requires no authentication whatsoever, meaning an attacker can run their own commands on the server without needing a password. Microsoft initially labeled it “exploitation more likely” rather than confirmed; that changed within days — Microsoft and CISA confirmed active exploitation and added it to the KEV catalog on July 16, 2026, with a federal remediation deadline of July 19, 2026.
One more vulnerability, CVE-2026-55040 (severity 9.1 of 10, an authentication bypass, also patched July 14, 2026), has not been confirmed as exploited yet but is flagged by Microsoft as a likely target — worth tracking even though it isn’t yet on the active-exploitation list.
These patches did not all ship at once. CVE-2026-32201 and CVE-2026-45659 have been available since April and May respectively — if either is still missing from your environment, it has been exploitable for months, not days. The other three shipped together in the July 14, 2026 Patch Tuesday update. If your patch management process runs on a monthly cadence, the July batch should already be applied. If it isn’t, that is the first fix — but not the only one.
Why this isn’t a normal patch-and-move-on situation
Here is the detail most patch-cycle checklists miss: during exploitation, attackers have been extracting the server’s Internet Information Services (IIS) machine keys — the cryptographic material SharePoint uses to sign and validate authentication tokens. Internet Information Services is Microsoft’s web server software, and the machine key is effectively the master signature that tells the server “this login is legitimate.”
Once an attacker has that key, they can forge valid-looking authentication tokens on demand. That forged access does not depend on the original vulnerability at all — so patching the hole they walked through does nothing to revoke a key they already copied on the way out. An organization can apply every available update and still have an attacker sitting inside its environment with a working set of forged credentials.
This is why the standard advice — “patch it and you’re done” — falls short here. The vulnerability is the entry point. The stolen key is the persistence mechanism, and it has to be dealt with separately.
How exposed is this, really
Shadowserver, a nonprofit that scans the internet for exposed systems, counted roughly 10,000 internet-facing SharePoint servers globally. As of mid-July 2026, more than 800 of them remained unpatched against at least two of the actively exploited flaws. This is not a niche, low-volume campaign.
CISA’s July 14 alert also placed this in a longer pattern: 11 SharePoint vulnerabilities have been actively exploited since November 2021, and 7 of those were later tied to ransomware deployment. This product line has a track record of being a foothold, not just a nuisance. Federal civilian agencies faced two back-to-back deadlines under CISA’s Binding Operational Directive 26-04 — an emergency-tier order requiring agencies to remediate or disconnect affected systems: July 17, 2026, specific to CVE-2026-56164, and July 19, 2026, added once CVE-2026-58644’s KEV listing confirmed active exploitation. Both deadlines have now passed. If the federal government treated this as urgent enough to mandate fixes on a matter of days, private-sector leadership should calibrate its own urgency accordingly.
It’s worth being precise about what is and isn’t confirmed: publicly available reporting establishes exposure counts and exploitation activity, but does not name specific breached organizations in a verifiable way. Treat any claim of a specific named victim with appropriate skepticism unless it comes from a confirmed, on-the-record source.
What to do this week
For any CISO or IT leader running on-premises SharePoint:
- Confirm all five patches are applied across every SharePoint Server instance, not just the ones you remember are internet-facing — the April and May updates as well as the July 14, 2026 batch.
- Rotate the IIS machine keys on those servers regardless of whether you’ve seen signs of compromise — this invalidates any forged tokens an attacker may already hold.
- Hunt for indicators of prior access: unexpected admin accounts, unusual authentication patterns, or activity predating your patch date.
- Ask your security team directly: “Have we rotated SharePoint’s IIS machine keys, and have we confirmed no forged-token access remains?” If the answer is no or uncertain, escalate it as an active incident.
Patching closes the door attackers walked through. Rotating the keys is what makes sure they don’t still have a copy of the house key.
This article is for general educational purposes only and does not constitute professional, legal, or security advice.
Sources & References
- CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- CISA Alert, July 14, 2026, “CISA Urges SharePoint Hardening After New Exploitations” — https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations
- CISA Alert, July 1, 2026, “CISA Adds One Known Exploited Vulnerability to Catalog” — https://www.cisa.gov/news-events/alerts/2026/07/01/cisa-adds-one-known-exploited-vulnerability-catalog
- Microsoft Security Update Guide, CVE-2026-45659 — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659
- NVD, CVE-2026-45659 detail — https://nvd.nist.gov/vuln/detail/CVE-2026-45659
- BleepingComputer, “CISA warns admins to patch actively exploited SharePoint flaws” — https://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-patch-actively-exploited-sharepoint-flaws/
- The Register, “CISA sounds alarm over trio of exploited SharePoint flaws” — https://www.theregister.com/security/2026/07/15/cisa-sounds-alarm-over-trio-of-exploited-sharepoint-flaws/5271814
- The Hacker News, “CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV” — https://thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html
- Rapid7, “CVE-2026-58644: Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the Wild” — https://www.rapid7.com/blog/post/etr-cve-2026-58644-microsoft-sharepoint-server-unauthenticated-remote-code-execution-vulnerability-exploited-in-the-wild/
- NVD, CVE-2026-56164 detail — https://nvd.nist.gov/vuln/detail/CVE-2026-56164
- CyCognito, “Emerging Threat: CVE-2026-56164 SharePoint Server Privilege Escalation via Missing Authentication” — https://www.cycognito.com/blog/emerging-threat-cve-2026-56164-sharepoint-server-privilege-escalation-via-missing-authentication/
- The Hacker News, “Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions” — https://thehackernews.com/2026/05/microsoft-patches-sharepoint-rce-flaw.html
- The Hacker News, “Microsoft Issues Patches for SharePoint Zero-Day and 168 Other New Vulnerabilities” — https://thehackernews.com/2026/04/microsoft-issues-patches-for-sharepoint.html
This article is for general educational purposes only and does not constitute professional, legal, or security advice.
