# CISA Warns of Active Exploitation of Three Microsoft SharePoint Server Vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164)

> CISA is warning that attackers are actively chaining three on-premises Microsoft SharePoint Server vulnerabilities — a spoofing/auth-bypass flaw, a deserialization RCE, and a missing-authentication privilege-escalation flaw — to bypass authentication, execute code, steal IIS/ASP.NET machine keys, and deploy malware for persistent access. Microsoft released patches on July 15, 2026, but Shadowserver counts nearly 10,000 internet-exposed SharePoint servers with over 800 still unpatched, and China-nexus actor Storm-2603 (GOLD SALEM) has previously paired this class of SharePoint bug with Warlock ransomware deployment.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1361
- **ID:** TL-2026-1361
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Storm-2603 (China)
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-32201, CVE-2026-45659, CVE-2026-56164

## Description

On July 14-15, 2026, CISA issued an urgent advisory warning that threat actors are actively exploiting three vulnerabilities affecting on-premises Microsoft SharePoint Server: CVE-2026-32201 (spoofing/authentication bypass via improper input validation, CVSS 6.5), CVE-2026-45659 (deserialization-of-untrusted-data remote code execution, CVSS 8.8, CWE-502), and CVE-2026-56164 (missing authentication for a critical function leading to elevation of privilege, CVSS 5.3, CWE-1220). All three affect on-premises SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016; SharePoint Online is not affected because Microsoft directly operates and patches that cloud service.

CVE-2026-32201 was patched April 14, 2026, and added to the CISA KEV catalog on that date; a public exploit (B1tBit/CVE-2026-32201-exploit) shows the flaw is triggered via crafted POST requests to SharePoint notification endpoints (e.g. /_layouts/15/notify.aspx) using a manipulated sender-override parameter, enabling reflected XSS in the security context of the SharePoint site — usable for phishing, credential theft, and spoofed authentication prompts. CVE-2026-45659 was patched May 12, 2026 (KB5002863, KB5002868, KB5002870) and added to KEV July 1, 2026 with a 3-day federal remediation deadline; it allows an attacker authenticated with only low Site Member privileges to submit serialized objects that SharePoint reconstructs without adequate validation, achieving remote code execution in the context of the IIS worker process (w3wp.exe). CVE-2026-56164 was disclosed and patched July 14-15, 2026 (Patch Tuesday, part of a record 570-622 CVE release) and immediately added to KEV the same day; it lets an unauthenticated attacker exploit a missing-authentication check over the network to elevate privileges with no user interaction.

Observed post-exploitation activity chains these bugs together: initial code execution leads to theft of ASP.NET/IIS machine keys, which attackers use to forge trusted view-state tokens and maintain authentication-bypass persistence even after the underlying vulnerability is patched — CISA explicitly warns that machine-key rotation alone is insufficient without first hunting for and removing machine-key harvesting implants. Attackers have deployed illegitimate .aspx web shells into SharePoint LAYOUTS directories (historically named similarly to spinstall0.aspx from the 2025 ToolShell campaign), then layered in redundant remote-access channels — Velociraptor (living-off-the-land use of a legitimate DFIR tool to blend in), Cloudflare Tunnels, Zoho Assist remote-access sessions, and SSH connections established through Visual Studio Code's remote extension — to survive incident-response cleanup of any single channel. Privilege escalation has included creation of new local and domain administrator accounts, and defense evasion via a vulnerable signed driver (NSecKrnl.sys) used to tamper with EDR/AV visibility. This activity mirrors the TTPs of Storm-2603 (aka GOLD SALEM), a China-based actor Microsoft has linked to prior SharePoint (ToolShell, CVE-2025-53770/53771) exploitation that culminated in deployment of Warlock ransomware via DLL search-order hijacking; Microsoft has also linked the broader 2025 ToolShell wave to additional China-nexus groups Linen Typhoon (APT27) and Violet Typhoon.

Shadowserver scanning found close to 10,000 internet-exposed on-premises SharePoint servers, with more than 800 still unpatched against CVE-2026-32201 and CVE-2026-45659 as of the CISA advisory. Federal civilian agencies were given until July 17, 2026 to remediate under BOD 26-04. Two related SharePoint vulnerabilities disclosed in the same patch wave, CVE-2026-55040 and CVE-2026-58644, were patched but not confirmed as actively exploited and are tracked separately. CISA recommends immediate patching, enabling AMSI integration with Windows Defender Antivirus (and setting SharePoint's Request Body Scan mode to Full), placing SharePoint behind a Layer 7 reverse proxy, restricting external access to SharePoint Central Administration, hunting for intrusion artifacts including machine-key harvesters before rotating IIS machine keys, and monitoring for anomalous child processes spawned from w3wp.exe.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1136 Create Account
- T1133 External Remote Services
- T1068 Exploitation for Privilege Escalation
- T1574 Hijack Execution Flow
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth
- T1036 Masquerading
- T1528 Steal Application Access Token
- T1606 Forge Web Credentials
- T1082 System Information Discovery
- T1087 Account Discovery
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1572 Protocol Tunneling
- T1219 Remote Access Tools
- T1486 Data Encrypted for Impact

## Sources

- [CISA Urges SharePoint Hardening After New Exploitations](https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations)
- [CISA warns admins to patch actively exploited SharePoint flaws](https://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-patch-actively-exploited-sharepoint-flaws/)
- [CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-45659)](https://www.cisa.gov/news-events/alerts/2026/07/01/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CVE-2026-32201: SharePoint Server Auth Bypass Vulnerability](https://www.sentinelone.com/vulnerability-database/cve-2026-32201/)
- [CVE-2026-32201: SharePoint Spoofing Vulnerability Enabling Unauthenticated Impersonation](https://securityboulevard.com/2026/04/cve-2026-32201-sharepoint-spoofing-vulnerability-enabling-unauthenticated-impersonation/)
- [B1tBit/CVE-2026-32201-exploit](https://github.com/B1tBit/CVE-2026-32201-exploit)
- [Microsoft Patch Tuesday for April 2026 fixed actively exploited SharePoint zero-day](https://securityaffairs.com/190831/security/microsoft-patch-tuesday-for-april-2026-fixed-actively-exploited-sharepoint-zero-day.html)
- [SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation](https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html)
- [High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659)](https://www.helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659/)
- [Hackers Use Velociraptor, Cloudflare Tunnels, Zoho Assist, and VS Code SSH for Persistence](https://cybersecuritynews.com/hackers-use-velociraptor-cloudflare-tunnels-zoho-assist/)
- [CVE-2026-45659: SharePoint on KEV and Warlock ransomware](https://hard2bit.com/en/blog/cve-2026-45659-sharepoint-kev-storm2603-warlock/)
- [CVE-2026-45659 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-45659)
- [CVE-2026-56164 SharePoint Exploit: Patch July 14 Now](https://windowsforum.com/threads/cve-2026-56164-sharepoint-exploit-patch-july-14-now.438466/)
- [Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/)
- [Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack](https://thehackernews.com/2026/07/microsoft-patches-record-622-flaws.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1361