SharePoint zero-day grants Farm Admin rights, CISA warns

CISA has updated its security advisories following active exploitation of multiple vulnerabilities in Microsoft SharePoint Server. Threat actors are targeting on-premises instances, including SharePoint Server 2016, 2019, and Subscription Edition, to achieve remote code execution and steal cryptographic secrets.

Vulnerabilities added to the KEV catalog

CISA has added several SharePoint flaws to its Known Exploited Vulnerabilities (KEV) catalog this year: CVE-2026-32201 (April 14), CVE-2026-45659 (July 1), CVE-2026-56164 (July 14), and CVE-2026-50522 (July 22), the last of which followed active exploitation after a public proof of concept appeared.

CVE-2026-56164 is an unauthenticated privilege escalation flaw. Microsoft resolved it as part of its July 2026 Patch Tuesday release.

CVE-2026-55040 is a separate authentication bypass vulnerability (CVSS 9.1) rooted in weak authentication. It requires no prior privileges or user interaction, letting attackers assume the identity of a SharePoint site user or administrator. Microsoft and Rapid7 disclosed it alongside the July Patch Tuesday release, but as of this writing it has not been confirmed as actively exploited and has not been added to the KEV catalog.

How the attack chain works

Once attackers gain a foothold, they chain deserialization vulnerabilities, among them CVE-2026-58644 and CVE-2026-50522, to execute arbitrary code with elevated permissions. A primary post-exploitation goal in these campaigns is theft of Internet Information Services (IIS) machine keys.

SharePoint uses these IIS machine keys to validate and decrypt ASP.NET ViewState data. Holding the keys lets attackers forge trusted requests and maintain administrative control. As a result, intruders can re-enter fully patched servers, deploy webshells, and bypass standard security controls long after updates have been applied.

Patching and key rotation are not enough on their own

CISA and security researchers stress that applying Microsoft's patches alone does not remediate a compromised system. Rotating IIS machine keys on an infected server without prior threat hunting is equally ineffective, since dormant machine-key harvester scripts can capture newly generated keys immediately.

Recommended mitigations

System administrators should perform thorough forensic artifact hunts across SharePoint farms before rotating machine keys. Organizations should also verify that full-mode Antimalware Scan Interface (AMSI) request inspection is active, restrict direct internet access to SharePoint instances, and ensure administrative interfaces sit behind authenticated reverse proxies.