Threat reportVulnerabilityTL-2026-1361
CISA Warns of Active Exploitation of Three Microsoft SharePoint Server Vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164)
CISA Warns of Active Exploitation of Three Microsoft (TL-2026-1361), also tracked as SharePoint Auth-Bypass/RCE/Machine-Key Chain, is a critical-severity software vulnerability scored CVSS 8.8, first published 2026-07-15. It is attributed to Storm-2603 (China) with medium confidence, affects Microsoft SharePoint Enterprise Server 2016, references 3 CVEs (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164), maps to 22 MITRE ATT&CK techniques (T1021, T1036, T1059), and is covered by 9 detection rules and 17 indicators of compromise.
- CVSS
- 8.8/10Critical
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 22MITRE ATT&CK
- Actors
- 1Storm-2603
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-1361
- Threat ID
- TL-2026-1361
- Also known as
- SharePoint Auth-Bypass/RCE/Machine-Key Chain
- Severity
- CRITICAL
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution
- Storm-2603
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- FINANCIAL
- Target sectors
- government administration, finance, health, education, technology, criticalinfrastructure
- Target regions
- North America, Europe, Asia-Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in CISA Warns of Active Exploitation of Three Microsoft
Malware and tooling: Warlock ransomware, CloudFlare Tunnel, Velociraptor, Zoho Assist
How CISA Warns of Active Exploitation of Three Microsoft works
CISA is warning that attackers are actively chaining three on-premises Microsoft SharePoint Server vulnerabilities — a spoofing/auth-bypass flaw, a deserialization RCE, and a missing-authentication privilege-escalation flaw — to bypass authentication, execute code, steal IIS/ASP.NET machine keys, and deploy malware for persistent access. Microsoft released patches on July 15, 2026, but Shadowserver counts nearly 10,000 internet-exposed SharePoint servers with over 800 still unpatched, and China-nexus actor Storm-2603 (GOLD SALEM) has previously paired this class of SharePoint bug with Warlock ransomware deployment.
On July 14-15, 2026, CISA issued an urgent advisory warning that threat actors are actively exploiting three vulnerabilities affecting on-premises Microsoft SharePoint Server: CVE-2026-32201 (spoofing/authentication bypass via improper input validation, CVSS 6.5), CVE-2026-45659 (deserialization-of-untrusted-data remote code execution, CVSS 8.8, CWE-502), and CVE-2026-56164 (missing authentication for a critical function leading to elevation of privilege, CVSS 5.3, CWE-1220). All three affect on-premises SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016; SharePoint Online is not affected because Microsoft directly operates and patches that cloud service.
CVE-2026-32201 was patched April 14, 2026, and added to the CISA KEV catalog on that date; a public exploit (B1tBit/CVE-2026-32201-exploit) shows the flaw is triggered via crafted POST requests to SharePoint notification endpoints (e.g. /_layouts/15/notify.aspx) using a manipulated sender-override parameter, enabling reflected XSS in the security context of the SharePoint site — usable for phishing, credential theft, and spoofed authentication prompts. CVE-2026-45659 was patched May 12, 2026 (KB5002863, KB5002868, KB5002870) and added to KEV July 1, 2026 with a 3-day federal remediation deadline; it allows an attacker authenticated with only low Site Member privileges to submit serialized objects that SharePoint reconstructs without adequate validation, achieving remote code execution in the context of the IIS worker process (w3wp.exe). CVE-2026-56164 was disclosed and patched July 14-15, 2026 (Patch Tuesday, part of a record 570-622 CVE release) and immediately added to KEV the same day; it lets an unauthenticated attacker exploit a missing-authentication check over the network to elevate privileges with no user interaction.
Observed post-exploitation activity chains these bugs together: initial code execution leads to theft of ASP.NET/IIS machine keys, which attackers use to forge trusted view-state tokens and maintain authentication-bypass persistence even after the underlying vulnerability is patched — CISA explicitly warns that machine-key rotation alone is insufficient without first hunting for and removing machine-key harvesting implants. Attackers have deployed illegitimate .aspx web shells into SharePoint LAYOUTS directories (historically named similarly to spinstall0.aspx from the 2025 ToolShell campaign), then layered in redundant remote-access channels — Velociraptor (living-off-the-land use of a legitimate DFIR tool to blend in), Cloudflare Tunnels, Zoho Assist remote-access sessions, and SSH connections established through Visual Studio Code's remote extension — to survive incident-response cleanup of any single channel. Privilege escalation has included creation of new local and domain administrator accounts, and defense evasion via a vulnerable signed driver (NSecKrnl.sys) used to tamper with EDR/AV visibility. This activity mirrors the TTPs of Storm-2603 (aka GOLD SALEM), a China-based actor Microsoft has linked to prior SharePoint (ToolShell, CVE-2025-53770/53771) exploitation that culminated in deployment of Warlock ransomware via DLL search-order hijacking; Microsoft has also linked the broader 2025 ToolShell wave to additional China-nexus groups Linen Typhoon (APT27) and Violet Typhoon.
Shadowserver scanning found close to 10,000 internet-exposed on-premises SharePoint servers, with more than 800 still unpatched against CVE-2026-32201 and CVE-2026-45659 as of the CISA advisory. Federal civilian agencies were given until July 17, 2026 to remediate under BOD 26-04. Two related SharePoint vulnerabilities disclosed in the same patch wave, CVE-2026-55040 and CVE-2026-58644, were patched but not confirmed as actively exploited and are tracked separately. CISA recommends immediate patching, enabling AMSI integration with Windows Defender Antivirus (and setting SharePoint's Request Body Scan mode to Full), placing SharePoint behind a Layer 7 reverse proxy, restricting external access to SharePoint Central Administration, hunting for intrusion artifacts including machine-key harvesters before rotating IIS machine keys, and monitoring for anomalous child processes spawned from w3wp.exe.
MITRE ATT&CK techniques used in TL-2026-1361
Lateral Movement
Defense Evasion
T1036 Masquerading; T1211 Exploitation for Stealth; T1574 Hijack Execution Flow
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol; T1219 Remote Access Tools; T1572 Protocol Tunneling
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Discovery
T1082 System Information Discovery; T1087 Account Discovery
Persistence
T1133 External Remote Services; T1136 Create Account; T1505 Server Software Component
Impact
T1486 Data Encrypted for Impact
Credential Access
T1528 Steal Application Access Token; T1606 Forge Web Credentials
Reconnaissance
defense-impairment
Affected products and versions in CISA Warns of Active Exploitation of Three Microsoft
- Microsoft — SharePoint Enterprise Server 2016
Vulnerable versions: 2016 (all builds prior to July 2026 CU)
Fixed in: 2016 with July 2026 security update - Microsoft — SharePoint Server 2019
Vulnerable versions: 2019 (all builds prior to July 2026 CU)
Fixed in: 2019 with KB5002868 and July 2026 security update - Microsoft — SharePoint Server Subscription Edition
Vulnerable versions: builds prior to 16.0.19725.20210 and prior to July 2026 CU
Fixed in: 16.0.19725.20210+ / July 2026 security update, KB5002863/KB5002870
Remediation for CISA Warns of Active Exploitation of Three Microsoft
Patches
- CVE-2026-32201: patched April 14, 2026
- CVE-2026-45659: patched May 12, 2026 (KB5002863, KB5002868, KB5002870)
- CVE-2026-56164: patched July 14-15, 2026 (July Patch Tuesday)
Immediate actions
- Apply the July 15, 2026 SharePoint security updates (KB5002863, KB5002868, KB5002870 and successors) for SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016
- Federal agencies must remediate per BOD 26-04 by July 17, 2026
- Hunt for and remove intrusion artifacts, including machine-key harvesters and unauthorized .aspx files in LAYOUTS directories, before rotating IIS/ASP.NET machine keys
- Rotate IIS/ASP.NET machine keys after confirming environment is clean
- Hunt for and remove all redundant persistence channels: Velociraptor deployments, Cloudflare Tunnel configurations, Zoho Assist sessions, and SSH via VS Code Remote
Workarounds
- Enable AMSI integration with Windows Defender Antivirus
- Set SharePoint Request Body Scan mode to Full
- Remove direct internet exposure of SharePoint Server instances
Longer-term hardening
- Place on-premises SharePoint Server behind a Layer 7 reverse proxy / WAF
- Restrict external network access to SharePoint Central Administration
- Deploy behavior-based detection for anomalous child processes spawned from w3wp.exe
- Monitor for creation of new local/domain administrator accounts
- Evaluate migration from on-premises SharePoint Server to SharePoint Online where feasible
CVEs associated with CISA Warns of Active Exploitation of Three Microsoft
Weaknesses (CWE) in CISA Warns of Active Exploitation of Three Microsoft
Timeline of CISA Warns of Active Exploitation of Three Microsoft
- Microsoft releases patch for CVE-2026-32201 (SharePoint spoofing/auth-bypass); CISA adds it to KEV the same day citing active exploitation.
- Microsoft releases patches (KB5002863, KB5002868, KB5002870) for CVE-2026-45659, a SharePoint deserialization RCE, initially assessed as exploitation 'less likely'.
- Active in-the-wild exploitation of CVE-2026-45659 confirmed roughly six weeks after patch release, contradicting the initial low-likelihood exploitation assessment.
- CISA adds CVE-2026-45659 to the Known Exploited Vulnerabilities catalog, setting a 3-day remediation deadline for federal agencies.
- CISA publishes 'CISA Urges SharePoint Hardening After New Exploitations,' warning of active chained exploitation of all three CVEs and citing Shadowserver data on nearly 10,000 exposed servers with 800+ unpatched.
- Microsoft's July 2026 Patch Tuesday (a record 570-622 CVEs) discloses and patches CVE-2026-56164, a missing-authentication elevation-of-privilege flaw in SharePoint; CISA immediately adds it to KEV the same day.
- Microsoft ships the consolidated July 2026 SharePoint security updates addressing CVE-2026-56164 alongside the earlier fixes; BleepingComputer reports on CISA's warning to admins.
- Federal civilian agency remediation deadline under Binding Operational Directive 26-04 for the actively exploited SharePoint vulnerabilities.
Sources cited for CISA Warns of Active Exploitation of Three Microsoft
- CISA Urges SharePoint Hardening After New Exploitations
- CISA warns admins to patch actively exploited SharePoint flaws
- CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-45659)
- CVE-2026-32201: SharePoint Server Auth Bypass Vulnerability
- CVE-2026-32201: SharePoint Spoofing Vulnerability Enabling Unauthenticated Impersonation
- B1tBit/CVE-2026-32201-exploit
- Microsoft Patch Tuesday for April 2026 fixed actively exploited SharePoint zero-day
- SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
- High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659)
- Hackers Use Velociraptor, Cloudflare Tunnels, Zoho Assist, and VS Code SSH for Persistence
- CVE-2026-45659: SharePoint on KEV and Warlock ransomware
- CVE-2026-45659 Detail - NVD
- CVE-2026-56164 SharePoint Exploit: Patch July 14 Now
- Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days
- Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack
Detection coverage for TL-2026-1361
As of 2026-07-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1361 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.