CISA has issued an advisory warning of active exploitation of three vulnerabilities (CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164) affecting all supported on-premises SharePoint Server versions — Subscription Edition, 2019, and 2016. Attackers are chaining these flaws to achieve remote code execution and then conducting post-exploitation activity, including stealing IIS machine keys and abusing deserialization to establish persistence and deploy malware. Two additional CVEs (CVE-2026-55040 and CVE-2026-58644) are newly disclosed and not yet exploited but flagged by Microsoft as risky if left unpatched.
The theft of IIS machine keys is particularly concerning from an identity standpoint: those keys allow attackers to forge authentication tokens and maintain access even after patching, effectively bypassing normal credential controls. SharePoint’s tight integration with on-prem Active Directory and service accounts makes a compromised server a strong pivot point for lateral movement and privilege escalation.
What to take away: Patching alone may not evict an attacker who has already harvested machine keys — organizations should apply Microsoft’s updates immediately, rotate machine keys and affected service account credentials, enable AMSI, and hunt for signs of forged tokens or persistence.