CISA Warns Admins to Patch Actively Exploited SharePoint Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that attackers are actively exploiting three vulnerabilities to hack Internet-exposed on-premises SharePoint Server instances. CISA urged security teams to closely monitor affected servers for signs o…
Intelligence analysis by Llama
CISA warned that attackers are actively exploiting three vulnerabilities to hack Internet-exposed on-premises SharePoint Server instances. The agency urged security teams to closely monitor affected servers for signs of exploitation and recommended applying Microsoft's latest patches.
Imagine you have a super powerful computer that can do lots of things, but it's not very good at keeping itself safe. That's kind of like what's happening with some computers that use a program called SharePoint. Some bad people are trying to hack into these computers to get inside and do bad things. The good news is that there are people who are trying to help keep these computers safe, and they're telling the people who take care of them to make sure they're patched up and secure.
Analysis
A $60B Vote of Confidence
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning to security teams to closely monitor Internet-exposed on-premises SharePoint Server instances for signs of exploitation. The agency's warning is a response to the discovery of three actively exploited vulnerabilities in SharePoint Server, which affect all supported self-hosted versions, including SharePoint Server Subscription Edition.
The vulnerabilities, tracked as CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, allow attackers to bypass authentication, gain remote code execution, and carry out post-exploitation activity, including stealing Internet Information Services machine keys and gaining persistence to deploy malware on compromised systems. The U.S. cybersecurity agency also flagged two more SharePoint Server vulnerabilities, CVE-2026-55040 and CVE-2026-58644, which Microsoft patched on Tuesday and tagged as attractive targets for attackers, although they are not yet known to have been exploited in the wild.
Internet security watchdog group Shadowserver currently tracks nearly 10,000 Internet-exposed Microsoft SharePoint servers, with over 800 of them unpatched against the CVE-2026-32201 and CVE-2026-45659 vulnerabilities. However, there are no details on how many of them are vulnerable to CVE-2026-56164 attacks or are honeypots.
CISA urged security teams to closely monitor affected servers for signs of exploitation and recommended applying Microsoft's latest patches, verifying successful installation, shortening patching cycles, as well as enabling Windows Antimalware Scan Interface (AMSI) integration for SharePoint web applications and using Microsoft Defender Antivirus (MDAV) detections to detect and remediate compromise. Additional hardening measures include hunting for and remediating intrusion artifacts before rotating IIS machine keys, establishing tailored logging to monitor for anomalous activity, avoiding direct internet exposure of SharePoint servers unless necessary, and reviewing Microsoft's official SharePoint Server security-hardening guidance.
It is also advisable to block external access to SharePoint Central Administration and restrict farm and database communication to the required systems. Where exposure is required, CISA also recommends placing servers behind a Layer 7 reverse proxy or similar application-layer security control.
CISA added the three actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog on April 14 (CVE-2026-32201), July 1 (CVE-2026-45659), and July 14 (CVE-2026-56164). Federal agencies have until July 17 to secure SharePoint servers affected by CVE-2026-56164 under Binding Operational Directive (BOD) 26-04 or discontinue them if mitigations cannot be applied.
In total, since November 2021, CISA has flagged 11 Microsoft SharePoint vulnerabilities that have been exploited in attacks, with 7 also exploited in ransomware attacks.
Key points
- CISA warned that attackers are actively exploiting three vulnerabilities to hack Internet-exposed on-premises SharePoint Server instances.
- The agency urged security teams to closely monitor affected servers for signs of exploitation and recommended applying Microsoft's latest patches.
- CISA added the three actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog on April 14 (CVE-2026-32201), July 1 (CVE-2026-45659), and July 14 (CVE-2026-56164).
- Federal agencies have until July 17 to secure SharePoint servers affected by CVE-2026-56164 under Binding Operational Directive (BOD) 26-04 or discontinue them if mitigations cannot be applied.
If security teams can quickly patch their systems and monitor for signs of exploitation, they may be able to prevent further attacks and keep their data safe. Additionally, the fact that CISA is warning about these vulnerabilities and providing guidance on how to mitigate them suggests that the cybersecurity community is taking steps to address the issue.
If security teams are unable to patch their systems quickly or monitor for signs of exploitation, they may be vulnerable to further attacks. Additionally, the fact that there are over 800 unpatched SharePoint servers suggests that the problem may be more widespread than initially thought.
