# CISA Warns of Trio of Actively Exploited SharePoint Server Flaws (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164)

> CISA issued an advisory on July 14, 2026 warning that three on-premises Microsoft SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) are under active exploitation, with attackers gaining remote code execution and post-compromise persistence via theft of IIS/ASP.NET machine keys and deserialization abuse. Two additional July 2026 Patch Tuesday flaws (CVE-2026-55040, CVE-2026-58644) are rated 'Exploitation More Likely' but not yet confirmed exploited.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-08-09T06:53:07.766Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1378
- **ID:** TL-2026-1378
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Storm-2603 (China)
- **Detections:** 9 · **IOCs:** 50 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-55040, CVE-2026-58644, CVE-2026-50522

## Description

On July 14, 2026, CISA published an advisory urging administrators to harden on-premises Microsoft SharePoint Server deployments after confirming active, in-the-wild exploitation of three vulnerabilities: CVE-2026-32201 (CVSS 6.5, spoofing via improper input validation enabling unauthenticated reflected XSS/impersonation, disclosed March 2026 and added to CISA's KEV catalog on 2026-04-14), CVE-2026-45659 (CVSS 8.8, remote code execution via deserialization of untrusted data, requiring only Site Member-level authentication, patched May 2026 and added to KEV on 2026-07-01 despite Microsoft's initial 'exploitation less likely' rating), and CVE-2026-56164 (CVSS 5.3, elevation of privilege via missing authentication for a critical function, shipped in July 2026 Patch Tuesday and added to KEV the same day it was disclosed, 2026-07-14).

All three affect every supported on-premises SharePoint Server edition (Subscription Edition, 2019, and 2016/Enterprise Server 2016); SharePoint Online/Microsoft 365 is not affected. Post-exploitation activity observed by CISA and Microsoft involves theft of IIS/ASP.NET machine keys and abuse of .NET deserialization to forge authentication tokens, maintain persistence across patch cycles, and deploy malware. This tradecraft mirrors the July 2025 'ToolShell' SharePoint campaign (CVE-2025-49704/49706/53770/53771), in which the China-based actor Storm-2603 (aka Warlock Group / GOLD SALEM), along with Linen Typhoon and Violet Typhoon, exploited on-prem SharePoint to drop the spinstall0.aspx web shell, exfiltrate ASP.NET machine keys via a crafted GET request, establish persistence through scheduled tasks and Group Policy Object modification, and ultimately deploy Warlock ransomware via DLL search-order hijacking. Storm-2603 has continued targeting on-prem SharePoint with the same machine-key-theft objective roughly a year later, reusing the tactic against the newly disclosed 2026 CVEs.

Two further July 2026 Patch Tuesday SharePoint flaws are not yet confirmed exploited but carry Microsoft's 'Exploitation More Likely' designation and CISA flagged them as high-priority: CVE-2026-55040 (CVSS 9.1, critical security-feature bypass; the first half of a two-bug chain whose second, still-embargoed component is expected to complete an unauthenticated RCE chain in August 2026) and CVE-2026-58644 (CVSS 9.8, critical unauthenticated network RCE). Shadowserver telemetry cited in coverage counted roughly 10,000 internet-exposed on-prem SharePoint instances, with over 800 still unpatched against CVE-2026-32201 and CVE-2026-45659 as of the advisory date. CISA's Binding Operational Directive timeline required FCEB agencies to remediate CVE-2026-45659 by 2026-07-04 and the newly added CVE-2026-56164/CVE-2026-32201 exploitation by 2026-07-17. Recommended mitigations include immediate patching, enabling AMSI integration for SharePoint (to catch malicious POST requests), deploying Microsoft Defender AV, placing a Layer 7 reverse proxy in front of SharePoint, restricting external access to SharePoint Central Administration, rotating ASP.NET machine keys after patching, and enhanced logging for anomalous IIS/w3wp.exe activity.

## MITRE ATT&CK

- T1590 Gather Victim Network Information
- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1053 Scheduled Task/Job
- T1078 Valid Accounts
- T1574 Hijack Execution Flow
- T1068 Exploitation for Privilege Escalation
- T1484 Domain or Tenant Policy Modification
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1055 Process Injection
- T1606 Forge Web Credentials
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1583 Acquire Infrastructure
- T1098 Account Manipulation
- T1134 Access Token Manipulation
- T1685 Disable or Modify Tools
- T1014 Rootkit
- T1556 Modify Authentication Process
- T1570 Lateral Tool Transfer
- T1219 Remote Access Tools
- T1596 Search Open Technical Databases
- T1036 Masquerading
- T1112 Modify Registry
- T1555 Credentials from Password Stores
- T1003 OS Credential Dumping

## Sources

- [CISA Urges SharePoint Hardening After New Exploitations](https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations)
- [CISA sounds alarm over trio of exploited SharePoint flaws](https://www.theregister.com/security/2026/07/15/cisa-sounds-alarm-over-trio-of-exploited-sharepoint-flaws/5271814)
- [CISA warns admins to patch actively exploited SharePoint flaws](https://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-patch-actively-exploited-sharepoint-flaws/)
- [CVE-2026-32201: SharePoint Server Auth Bypass Vulnerability](https://www.sentinelone.com/vulnerability-database/cve-2026-32201/)
- [GitHub PoC: CVE-2026-32201-exploit (reflected XSS via spoofing flaw)](https://github.com/B1tBit/CVE-2026-32201-exploit)
- [SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation](https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html)
- [Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions](https://thehackernews.com/2026/05/microsoft-patches-sharepoint-rce-flaw.html)
- [CVE-2026-45659: Microsoft SharePoint Server Deserialization Remote Code Execution (CISA KEV)](https://threat-modeling.com/cve-2026-45659-microsoft-sharepoint-deserialization-rce-cisa-kev/)
- [CVE-2026-45659, SharePoint on KEV and Warlock ransomware (campaign continuity analysis)](https://hard2bit.com/en/blog/cve-2026-45659-sharepoint-kev-storm2603-warlock/)
- [Security Update Guide - CVE-2026-45659](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659)
- [CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability](https://www.securityweek.com/cisa-warns-of-actively-exploited-microsoft-sharepoint-vulnerability/)
- [Microsoft Patch Tuesday - July 2026 (SharePoint CVE-2026-55040, CVE-2026-58644, CVE-2026-56164)](https://www.lansweeper.com/blog/patch-tuesday/microsoft-patch-tuesday-july-2026/)
- [The July 2026 Security Update Review](https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review)
- [Disrupting active exploitation of on-premises SharePoint vulnerabilities (ToolShell precursor campaign)](https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/)
- [Storm-2603 Exploits SharePoint Flaws to Deploy Warlock Ransomware on Unpatched Systems](https://thehackernews.com/2025/07/storm-2603-exploits-sharepoint-flaws-to.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1378