SharePoint Under Siege: Five CVEs Exploited in Three Months — What It Means for Enterprise Security
Between April and July 2026, CISA added five Microsoft SharePoint Server vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, one after another. From CVE-2026-32201 to CVE-2026-50522, attackers have not only been discovering new entry points but also maintaining access in patched environments by stealing Internet Information Services (IIS) machine keys. This is not an isolated incident — it is a pattern sending a clear signal: SharePoint, as an enterprise’s core collaboration platform, has become a high-value target for attackers.
Five CVEs in Three Months: No Coincidence
On July 14, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a security alert[^1] confirming the following SharePoint Server vulnerabilities are being actively exploited:
| CVE ID | Disclosure Date | CVSS Score | Description |
|---|---|---|---|
| CVE-2026-32201 | April 14 | — | First SharePoint RCE added to KEV |
| CVE-2026-45659 | July 1 | — | Second actively exploited vulnerability |
| CVE-2026-56164 | July 14 | 9.8 (Critical) | RCE; federal agencies given 3 days to patch |
| CVE-2026-58644 | July 16 | — | Added to KEV |
| CVE-2026-50522 | July 22 | — | Latest addition |
This timeline reveals an important pattern: attackers are not discovering a single vulnerability and stopping. They are continuously tracking SharePoint’s patch cycle and probing for new entry points. Even as early adopters complete initial patches, attackers maintain alternative access through other unaddressed gaps.
The Real Danger Is Not RCE — It’s Stolen Machine Keys
The most critical element of this exploit chain is not remote code execution itself, but what happens afterward: attackers steal IIS machine keys to maintain persistent access.
IIS machine keys are used for ASP.NET view state encryption and authentication token signing. Once compromised, attackers can:
- Forge valid authentication tokens for unrestricted SharePoint access
- Decrypt and tamper with view state data for further attacks
- Maintain a stealthy presence even after the original RCE vulnerability is patched
As security researchers have noted: if a team patches the RCE today but never rotates keys that may have been stolen months ago, they have locked the front door while leaving a spare set of keys in the attacker’s pocket.
Why SharePoint Is a High-Value Target
SharePoint Server’s role in enterprises goes far beyond “file sharing.” Over time, it naturally accumulates an organization’s most sensitive information assets:
- Engineering documentation and technical architecture
- HR records and employee data
- Financial reports and contracts
- Security policies and procedures
- Internal system architecture diagrams and credentials
When attackers gain code execution on a SharePoint server, they obtain far more than file server access — they gain a roadmap of how the organization operates. This information dramatically accelerates lateral movement, privilege escalation, and subsequent attacks.
Critically, SharePoint is typically deeply integrated with Active Directory and maintains trust relationships with CRM, ERP, and BI systems. A compromised SharePoint server often becomes the launchpad for attackers to reach an enterprise’s core network.
Three Organizational Lessons
Patch Management Cannot Be “Month-to-Month”
The three-month spread of these vulnerabilities exposes a common blind spot: organizations that missed early patches may remain exposed for months. Patch management must evolve from “apply when received” to “continuously track the patch chain” — especially when vulnerabilities in the same product appear in rapid succession.
Incident Response Must Cover Post-Exploitation
Traditional vulnerability response processes typically end at “install the patch.” But IIS machine key rotation, log auditing, and intrusion artifact hunting are equally critical. CISA’s latest alert emphasizes: before rotating machine keys, hunt for and remediate any deployed key-stealing tools — otherwise, rotation is meaningless.
Layered Security Architecture Beats Patching Alone
CISA recommends placing SharePoint Servers behind a Layer 7 reverse proxy with authentication and request inspection, enabling AMSI (Antimalware Scan Interface) in Full Mode for malicious request body detection, and strictly restricting external access to SharePoint Central Administration. These measures raise the attacker’s cost and provide additional protection during the window between vulnerability disclosure and patch deployment.
Three Actionable Steps for Security Teams
1. Verify SharePoint Versions and Patch Status Immediately Confirm that all supported SharePoint Server editions (Subscription Edition, 2019, 2016) have the latest security updates through July 2026.
2. Rotate IIS Machine Keys — But Hunt for Intrusion First Before rotation, conduct a full scan using CISA’s MDAV detection signature (Backdoor:MSIL/LeakFang.A!dha) and AMSI detection signatures.
3. Enable SharePoint AMSI Integration and Audit Logging Configure AMSI “Full Mode” per Microsoft’s guidance, and establish log monitoring for anomalous requests, SharePoint worker process anomalies, and machine key access.
DELine Technology provides enterprise security incident response and vulnerability management services, including security assessment, patch management process optimization, security architecture hardening, and security operations system building. Our consulting team brings ISO 27001 certification auditing and ITSS service standard experience, helping organizations build complete security capabilities from vulnerability discovery to remediation closure. To learn more about vulnerability response solutions or schedule a security assessment, visit our website or reach out through our contact page.
[^1]: CISA, “CISA Urges SharePoint Hardening After New Exploitations,” July 14, 2026 (updated July 28). https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations
