CISA Warns of Active Exploitation of Three SharePoint Server Flaws

Summary

CISA says attackers are exploiting three flaws in internet-exposed, on-premises SharePoint Server to bypass authentication, execute code, and steal IIS machine keys. It urges patching, monitoring, and hardening; two other patched flaws are not known to be exploited.

Key points

CISA reports active exploitation of CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 in supported self-hosted SharePoint Server versions, including Subscription Edition.
The flaws can enable authentication bypass, remote code execution, and post-exploitation activity including IIS machine-key theft and persistence.
Microsoft patched two additional SharePoint flaws, CVE-2026-55040 and CVE-2026-58644; CISA says they are attractive targets, but not known to be exploited in the wild.
Shadowserver tracks nearly 10,000 internet-exposed SharePoint servers; more than 800 are unpatched against CVE-2026-32201 and CVE-2026-45659. The article says exposure to CVE-2026-56164 and honeypot counts are unknown.
CISA recommends applying and verifying patches, shortening patch cycles, enabling AMSI integration and Defender detections, and monitoring for exploitation.
Additional guidance includes reducing internet exposure, restricting access to Central Administration, reviewing logs and intrusion artifacts, and using an application-layer control where exposure is necessary.

Article Details

Vulnerability Types: Authentication bypass
Remote code execution
Affected Versions: SharePoint Server (all supported self-hosted versions, including SharePoint Server Subscription Edition)
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available
Workarounds: Apply Microsoft’s latest patches and verify successful installation.
Enable AMSI integration for SharePoint web applications and use Microsoft Defender Antivirus detections to detect and remediate compromise.
Avoid direct Internet exposure of SharePoint servers unless necessary; where exposure is required, place them behind a Layer 7 reverse proxy or similar application-layer security control.
Block external access to SharePoint Central Administration and restrict farm and database communication to required systems.
Monitor for anomalous activity and remediate intrusion artifacts before rotating IIS machine keys.