BCY-ADV-2026-017
CRITICAL — CISA HARDENING ALERT
Microsoft SharePoint Server — Four Active CVEs, CISA Hardening Alert
CVE-2026-56164 Zero-Day · CVE-2026-45659 Deserialization RCE · IIS Machine Key Theft · Malware Deployment
CVE-2026-56164
CVE-2026-45659
CVE-2026-32201
CVE-2026-58644
CISA KEV
Zero-Day
RCE
Deserialization
IIS Key Theft
SharePoint
On-Premises
Actively Exploited
Prepared by Warren Barr · Barr Cyber LLC · barr-cyber.com · July 2026
What This Is
CISA issued a dedicated hardening alert for on-premises Microsoft SharePoint Server on July 14, 2026 — a relatively rare move that signals something beyond the normal patch-Tuesday advisory cadence. The alert identifies four CVEs being actively exploited in combination to gain unauthorized access, execute code, establish persistence, and deploy malware on SharePoint Server installations. Three of the four were already in CISA's KEV catalog; the fourth, CVE-2026-58644, was added July 16 as exploitation was confirmed.
The most urgent of the four is CVE-2026-56164, a zero-day discovered by Jayson Frost and Genwei Jiang of Mandiant and Google Cloud's FLARE Offensive Task Force — attribution that means it was found during active incident response, not during routine research. Microsoft assigned it a CVSS of 5.3 ("Moderate"). The National Vulnerability Database independently scored it 9.8 (Critical). It is unauthenticated, pre-auth, network-based, and requires no user interaction. CISA added it to KEV on the same day July Patch Tuesday patches shipped.
Microsoft's CVSS score of 5.3 is being unanimously criticized by the security industry. NVD scored it 9.8. It is unauthenticated, pre-auth, remote, no-click, and actively being exploited in the wild. Do not use the vendor CVSS score to prioritize this one. Patch on-premises SharePoint immediately and treat any internet-facing instance as potentially compromised.
The Four CVEs
CVE-2026-56164 — Microsoft CVSS 5.3 | NVD CVSS 9.8 — CWE-306 (Missing Authentication for Critical Function)
A missing authentication check for a critical SharePoint API function accessible over the network. An unauthenticated remote attacker can call this function and escalate privileges on the SharePoint Server. Found by Mandiant/FLARE during an active intrusion. CISA KEV July 14, 2026. Affects SharePoint Server 2016, 2019, and Subscription Edition.
CVE-2026-45659 — CVSS 8.8 — Deserialization of Untrusted Data (RCE)
A deserialization vulnerability that allows an authenticated attacker with minimum Site Member permissions to execute arbitrary code remotely on the SharePoint Server. No admin privileges required — a basic site account is enough. Patched in May 2026, CISA KEV July 1, 2026. Storm-2603 (Warlock ransomware operator) has been observed exploiting this alongside the unauthenticated flaws.
CVE-2026-32201 — CVSS not published — RCE
An earlier SharePoint RCE added to CISA KEV in April 2026. Attackers chaining this with the newer flaws for persistence and lateral movement.
CVE-2026-58644 — CVSS 9.8 — RCE
The highest-scored of the cluster. Added to CISA KEV July 16, 2026. Microsoft July Patch Tuesday fix. Chained with CVE-2026-56164 in observed attacks.
Affected: All supported on-premises SharePoint Server versions: Subscription Edition, 2019, and 2016
SharePoint Online (Microsoft 365): Not affected — this is an on-premises-only issue
Post-Exploitation: IIS Machine Key Theft
CISA's hardening alert specifically calls out a post-exploitation technique that distinguishes these attacks from routine SharePoint compromises: IIS machine key theft. After gaining code execution on a SharePoint Server, attackers are extracting the IIS machine key from the server's configuration. The machine key is used by ASP.NET applications (including SharePoint) to protect session state, view state, and other sensitive data via encryption and HMAC signing.
With the machine key, an attacker can forge ViewState objects for any ASP.NET application on the server that shares the same key, enabling further deserialization attacks and code execution without valid credentials. This technique enables persistence that survives patching — even after the original vulnerability is remediated, a stolen machine key gives the attacker a persistent path back into the application.
CISA's alert notes that attackers are using this technique to "establish persistence and deploy malware" as a second-stage activity following initial access via the CVEs listed above.
Detection
Verify SharePoint Server patch level:
# In SharePoint Central Administration:
# Upgrade and Migration → Review database status
# Or via PowerShell:
Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
(Get-SPFarm).BuildVersion
# Cross-reference against Microsoft's July 2026 build numbers for your edition
Hunt for IIS machine key theft indicators:
# Check IIS configuration for machine key values
# If the machineKey in web.config or applicationHost.config
# has validation/decryption keys, consider them potentially exposed
# If exploitation is suspected, rotate them (see Remediation)
# Look for unexpected access to web.config or applicationHost.config in IIS logs:
Get-WinEvent -LogName "Security" | Where-Object {
$_.Id -eq 4663 -and $_.Message -match "web.config|applicationHost"
} | Select-Object TimeCreated, Message | Format-List
Hunt for webshells and unexpected files in SharePoint directories:
# SharePoint web root — look for recently modified ASPX files
Get-ChildItem -Path "C:\inetpub\wwwroot\wss\" -Recurse -Include "*.aspx","*.asmx" |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
Select-Object FullName, LastWriteTime
# Check for files not matching expected SharePoint structure
Get-ChildItem -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\" `
-Recurse -Include "*.aspx","*.dll" |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
Select-Object FullName, LastWriteTime
Enable AMSI on SharePoint as an interim mitigation (CISA recommended):
# SharePoint 2019 and Subscription Edition support AMSI integration
# This can detect and block malicious ViewState deserialization attempts
# Enable via SharePoint Central Administration:
# Security → General Security → Configure AMSI
# PowerShell (Subscription Edition):
$contentService = [Microsoft.SharePoint.Administration.SPWebService]::ContentService
$contentService.AMSIEnabled = $true
$contentService.Update()
IOCs
CVEs active CVE-2026-56164 (pre-auth EoP), CVE-2026-45659 (deser RCE),
CVE-2026-32201 (RCE), CVE-2026-58644 (RCE CVSS 9.8)
Post-exploitation IIS machine key theft → forged ViewState → persistent RCE
Threat actor Storm-2603 (Warlock ransomware) observed exploiting CVE-2026-45659
Discovery CVE-2026-56164 found by Mandiant/FLARE during live incident response
CISA alert Dedicated SharePoint hardening advisory — July 14, 2026
Affected scope On-premises SharePoint Server 2016, 2019, Subscription Edition ONLY
Not affected SharePoint Online (Microsoft 365)
Remediation
Sources & References
BCY-ADV-2026-017 · Published July 2026 · Barr Cyber LLC · Kalispell, MT
More like this, when it happens
Advisories only. No newsletter, no marketing, unsubscribe in one click.
Barr Cyber — Application Security & Endpoint Hardening
On-premises SharePoint Server is a common finding in small and mid-sized organization assessments — often unpatched, internet-facing, and running on end-of-life versions. If your SharePoint environment has not been reviewed since this advisory, contact Barr Cyber.
Get in Touch →
