SharePoint Zero-Day: Patches Aren't Enough — The Real Danger Is…

Attackers are actively exploiting zero-day vulnerabilities in Microsoft SharePoint Server on-premises to gain administrative privileges, steal IIS machine keys, and maintain persistence even on fully patched servers. A July 14, 2026 CISA alert turned a routine patching cycle into a race against time where the security checklist risks becoming an illusion.

Attackers are actively exploiting zero-day vulnerabilities in Microsoft SharePoint Server on-premises to gain administrative privileges, steal IIS machine keys, and maintain persistence even on fully patched servers. The July 14, 2026 alert from the Cybersecurity and Infrastructure Security Agency (CISA) turned a routine patching cycle into a race against time where the security checklist risks becoming an illusion.

Key Takeaways

CISA confirmed active exploitation of five CVEs in SharePoint Server on-premises, with entries added to the Known Exploited Vulnerabilities catalog between April 14 and July 22, 2026.
Two of the flaws — CVE-2026-58644 and CVE-2026-56164 — carry a CVSS 9.8 CRITICAL rating per official NVD records, enabling unauthenticated RCE and privilege escalation.
Attackers steal IIS machine keys to forge trusted ASP.NET ViewState, enabling re-entry on patched servers and webshell deployment.
CISA warns that key rotation without threat hunting is ineffective: dormant harvester scripts can capture new keys immediately.

CISA Confirms the Chain: From Unauthenticated Access to Farm Admin

On July 14, 2026, CISA issued an unprecedented alert given the severity of the attack mechanism. The U.S. federal agency listed five actively exploited vulnerabilities: CVE-2026-32201 (April 14), CVE-2026-45659 (July 1), CVE-2026-56164 (July 14), CVE-2026-58644 (July 16), and CVE-2026-50522 (July 22). Per the alert text: "CISA is aware of active exploitation of vulnerabilities CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522 enabling cyber threat actors to gain unauthorized access to on-premises SharePoint Server instances" [SOURCE 3].

The technical chain reconstructed from primary sources begins with unauthenticated access via CVE-2026-56164, a privilege escalation vulnerability patched in the July 2026 Patch Tuesday. Attackers then chain deserialization vulnerabilities — CVE-2026-58644 and CVE-2026-50522, both rated CVSS 9.8 CRITICAL by NVD [SOURCE 6, SOURCE 7] — to achieve RCE with elevated privileges. CVE-2026-58644 was initially disclosed without zero-day exploited status, but Microsoft later revised its bulletin to confirm in-the-wild exploitation, as reported by The Hacker News: "Microsoft has since revised its bulletin to clarify that CVE-2026-58644 has been exploited in the wild, meaning the shortcoming was weaponized as a zero-day prior to the fixes becoming available" [SOURCE 4].

"intruders can re-enter fully patched servers, deploy webshells, and bypass standard security controls long after updates have been applied" — Notebookcheck, technical summary based on CISA advisory

The Theft of IIS Machine Keys: Why Patching Becomes Illusory

The point of no return in this attack is not the initial compromise, but the theft of IIS machine keys. These keys — used by Internet Information Services to validate and decrypt ASP.NET ViewState data — become a permanent passport once in attackers' hands. CISA explicitly documents "post-exploitation activities, such as stealing Internet Information Services (IIS) machine keys" [SOURCE 3].

The consequence is counter-intuitive and devastating: a patched server remains vulnerable. With the stolen keys, attackers can forge trusted ViewState that the system legitimately accepts, bypassing every post-update control. Notebookcheck summarizes the mechanism: intruders "can re-enter fully patched servers, deploy webshells, and bypass standard security controls long after updates have been applied" [SOURCE 1].

The persistence risk is amplified by CVE-2026-50522, which entered the KEV catalog on July 22 after a public proof of concept appeared [SOURCE 1]. The timeline — five CVEs in four months, three in ten days — suggests a coordinated operation rather than isolated exploits, though the specific identity of the threat actors and the scale of exploitation do not emerge from available sources.

Federal Deadlines and the Checklist Trap

CISA activated Binding Operational Directive 22-01 procedures for Federal Civilian Executive Branch (FCEB) agencies, setting rigid deadlines: July 17, 2026 for CVE-2026-56164 [SOURCE 5], July 19, 2026 for CVE-2026-58644 [SOURCE 4], and July 25, 2026 for CVE-2026-50522 [SOURCE 7]. For private organizations, these dates signal operational urgency but also a paradox: those who already patched by the deadlines may still be compromised.

The technical angle that makes this campaign insidious is the discrepancy between visible remediation activity and actual resilience. Rotating IIS machine keys — the logical countermeasure after patching — is ineffective if performed without prior threat hunting. CISA states this unequivocally: "Before rotating IIS machine keys, hunt for and remediate any intrusion artifacts, including machine-key harvesters, that could allow for the keys to be stolen again" [SOURCE 3]. A dormant harvester script captures new keys the moment they are generated, rendering rotation a futile gesture.

What to Do Now

The actions documented by primary sources are four, in strict order:

Threat hunting before any rotation: identify and remove intrusion artifacts, including machine-key harvesters, before generating new IIS machine keys [SOURCE 3].
Enable AMSI in full mode: the Anti-Malware Scan Interface must operate in full mode to detect in-memory payloads, per CISA's specific recommendation for this event [SOURCE 3].
Remove direct internet access: SharePoint Server on-premises must not be exposed directly to the public internet; CISA prescribes authenticated reverse proxies [SOURCE 3].
Apply Microsoft patches for affected versions: SharePoint Server 2016, 2019, and Subscription Edition [SOURCE 3], with the understanding that patching alone does not eliminate persistence if keys have already been exfiltrated.

A note on CVE-2026-55040: with a CVSS 9.1 score, this authentication bypass vulnerability was disclosed but is NOT confirmed as exploited and is NOT present in the KEV catalog [SOURCE 1]. The dossier does not allow determining whether it represents a potential risk or an active one not yet detected.

Why Companies Remain Exposed Even When They Do Everything Right

The SharePoint 2026 case exposes a structural flaw in enterprise cybersecurity: the equation "patch = security" breaks when persistence is built on stolen cryptographic material, not vulnerable code. IIS machine keys are not user credentials: they do not expire, they do not generate anomalous alerts, they do not appear in logs as suspicious access. They are a trust mechanism of the ASP.NET framework, and their compromise transforms the platform into a system that legitimately authenticates the attacker.

The absence of confirmed attribution, data on victim scale, and indications of any linked ransomware campaigns — CISA lists "Unknown" for ransomware association in the KEV catalog — leaves uncertainty gaps that organizations must manage with operational conservatism. What is documented is sufficient to act: active exploitation, a post-patch persistence mechanism, and specific countermeasures that require rigorous ordering.

The real stake is methodological. If threat hunting becomes a prerequisite for patching, the checklist security model — patch, rotate, close the ticket — loses validity. Enterprises with SharePoint on-premises must verify whether their remediation processes include active search for pre-rotation artifacts, or whether they are deploying patches that apparently close windows left wide open in reality.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter