July 2026 SharePoint Flaw Analysis Details Exploit Chains and Defenses
Summary
The article says CISA confirmed active exploitation of three of six flaws in on-premises SharePoint Server. It describes web-shell and machine-key theft techniques, lists affected builds and patches, and recommends AMSI scanning, threat hunting, and network hardening.
Key points
- The article attributes CISA confirmation of active exploitation to CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164.
- It covers six vulnerabilities affecting on-premises SharePoint Server; SharePoint Online and Microsoft 365 are described as unaffected.
- The article also discusses CVE-2026-55040, CVE-2026-58644, and CVE-2026-50522, including unauthenticated attack paths and patch priorities.
- It outlines a possible chain involving crafted requests, web shells, ASP.NET machine-key theft, ViewState forgery or IIS module persistence, and lateral movement.
- It lists affected SharePoint versions and July 2026 build numbers, and recommends applying updates across all farm servers.
- Recommended defenses include enabling AMSI request-body scanning, restricting internet exposure, monitoring IIS and Windows logs, and hunting for suspicious files and processes.
- The Operation FarmKey breach simulation is explicitly identified as fictional, not a report of a real incident.
Article Details
- Attack Vectors
- Attackers target internet-exposed, on-premises SharePoint Server with crafted HTTP requests. The article reports active exploitation of CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164; the deserialization flaw in CVE-2026-45659 requires site-member permissions, while other described paths can be unauthenticated.
- The article describes unsafe deserialization and JWT validation bypass as paths to remote code execution or impersonation. It says CVE-2026-55040 was not observed in active attacks at disclosure; Rapid7 identified it as part of a two-bug chain for unauthenticated RCE.
- After code execution, attackers may deploy ASP.NET web shells, extract IIS machineKey values from web.config, forge ViewState payloads, or install malicious IIS modules for persistence.
- The article describes using the SharePoint farm account to access databases and pivot toward Active Directory and other internal systems. Its NTLM-relay and cloud-storage exfiltration sequence is explicitly a fictional breach simulation, not a reported incident.
- Defensive Notes
- Apply the July 2026 SharePoint Server security updates across all farm servers, verify patch installation, and prioritize the additional vulnerabilities identified in the article. The article says a companion RCE component in the CVE-2026-55040 chain was expected to be patched in the August 2026 update.
- Enable AMSI integration for every web application and use Request Body Scan Full Mode where feasible.
- Hunt for suspicious ToolPane requests, spoofed Referer headers, unexpected child processes from w3wp.exe, encoded PowerShell, new files under SharePoint layouts or inetpub directories, and unauthorized IIS modules or machineKey changes.
- Enable detailed IIS logging, forward IIS, Windows Event, and SharePoint ULS logs to a SIEM, and alert on IIS worker processes spawning shells or compiling code.
- Reduce exposure by avoiding direct internet access to SharePoint, restricting access to Central Administration, and limiting farm and database communications to required systems.
- Investigate and remediate intrusion artifacts before rotating IIS machine keys.
MITRE ATT&CK
T1036.008 · Masquerade File TypeIn the fictional simulation, staged files use innocuous .log and .tmp extensions to blend in with routine farm output.T1059.001 · PowerShellThe article describes PowerShell execution with encoded commands in its exploit examples and detection guidance.T1059.003 · Windows Command ShellThe article describes SharePoint's IIS worker process spawning cmd.exe, including as an outcome of a deserialization payload.T1071.001 · Web ProtocolsIn the explicitly fictional breach simulation, a reverse shell communicates with an attacker C2 server over port 443.T1190 · Exploit Public-Facing ApplicationAttackers exploit vulnerabilities in exposed, on-premises SharePoint Server endpoints; the article reports active exploitation of three SharePoint CVEs.T1213.002 · SharepointThe article describes unauthorized access to SharePoint documents, sites, and list data.T1505.003 · Web ShellThe article describes attackers deploying ASP.NET web shells, including the reported spinstall0.aspx example, to maintain server access.T1505.004 · IIS ComponentsThe article describes persistence through a malicious native IIS module registered in applicationHost.config; its detailed FarmAuthNative.dll example is part of a fictional simulation.T1552.001 · Credentials In FilesAttackers are described reading ASP.NET machineKey values, including validationKey and decryptionKey, from SharePoint configuration to forge ViewState payloads.T1557.001 · Name Resolution Poisoning and SMB RelayThe fictional simulation describes capturing an NTLM challenge/response through an HTTP request to a controlled SMB listener and relaying it to a database server.T1560.001 · Archive via UtilityThe fictional simulation describes compressing sensitive documents and list exports into archives before exfiltration.T1567.002 · Exfiltration to Cloud StorageThe fictional simulation describes sending archive chunks over HTTPS to a compromised cloud-storage endpoint.
CVE
CVE-2026-32201The actively exploited CVEs — CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 — affect all supported on-premises SharePoint versions (Subscription Edition, 2019, and 2016).CVE-2026-45659The actively exploited CVEs — CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 — affect all supported on-premises SharePoint versions (Subscription Edition, 2019, and 2016).CVE-2026-50522In the same update cycle, Microsoft also disclosed CVE-2026-55040 (JWT authentication bypass), CVE-2026-58644 (unauthenticated deserialization RCE), and CVE-2026-50522 (additional unauthenticated deserialization RCE).CVE-2026-55040In the same update cycle, Microsoft also disclosed CVE-2026-55040 (JWT authentication bypass), CVE-2026-58644 (unauthenticated deserialization RCE), and CVE-2026-50522 (additional unauthenticated deserialization RCE).CVE-2026-56164The actively exploited CVEs — CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 — affect all supported on-premises SharePoint versions (Subscription Edition, 2019, and 2016).CVE-2026-58644In the same update cycle, Microsoft also disclosed CVE-2026-55040 (JWT authentication bypass), CVE-2026-58644 (unauthenticated deserialization RCE), and CVE-2026-50522 (additional unauthenticated deserialization RCE).
Vendors
Products
IISBecause SharePoint integrates closely with technologies such as Active Directory, SQL Server, and Microsoft IIS, it often occupies a trusted position within enterprise environments.Microsoft 365 Apps for EnterpriseSharePoint Online and Microsoft 365 are not affected because Microsoft manages those environments.Microsoft Active DirectoryBecause SharePoint integrates closely with technologies such as Active Directory, SQL Server, and Microsoft IIS, it often occupies a trusted position within enterprise environments.Microsoft SharePoint ServerMicrosoft SharePoint Server is one of the most widely deployed enterprise collaboration and content management platforms, serving as a central repository for business-critical documents, workflows, and organizationalSharePoint OnlineSharePoint Online and Microsoft 365 are not affected because Microsoft manages those environments.SharePoint Server 2016Microsoft SharePoint Server 2016 (Enterprise)SharePoint Server 2019Microsoft SharePoint Server 2019 (Standard and Enterprise)SharePoint Server Subscription EditionMicrosoft SharePoint Server Subscription EditionSQL ServerBecause SharePoint integrates closely with technologies such as Active Directory, SQL Server, and Microsoft IIS, it often occupies a trusted position within enterprise environments.
Tools
CensysShodan/Censys searches for SharePoint-specific HTTP headers and /_layouts/15/ paths.ShodanShodan/Censys searches for SharePoint-specific HTTP headers and /_layouts/15/ paths.ysoserial.netWith the stolen keys, the attacker crafts a malicious ViewState payload using ysoserial.net or a custom serializer.
Industries
Defensesecurity boundary and prioritize timely patching, continuous monitoring, proactive threat hunting, and defense-in-depth controls to reduce the risk of large-scale compromiseFinancial ServicesOrganization: A mid-sized regional financial services firm with an on-premises SharePoint Server 2019 farm.GovernmentGovernment and regulated sectors