The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned Tuesday that attackers are actively exploiting three vulnerabilities to hack Internet-exposed on-premises SharePoint Server instances.
These security flaws (tracked as CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164) affect all supported self-hosted SharePoint Server versions, including SharePoint Server Subscription Edition (the latest on-premises version, which uses a “continuous update” model).
As detailed in a Tuesday advisory, attackers are exploiting these vulnerabilities to bypass authentication, gain remote code execution, and carry out post-exploitation activity, including stealing Internet Information Services machine keys and gaining persistence to deploy malware on compromised systems.
The U.S. cybersecurity agency also flagged two more SharePoint Server vulnerabilities (CVE-2026-55040 and CVE-2026-58644), which Microsoft patched on Tuesday and tagged as attractive targets for attackers, although they are not yet known to have been exploited in the wild.
Internet security watchdog group Shadowserver currently tracks nearly 10,000 Internet-exposed Microsoft SharePoint servers, over 800 of them unpatched against the CVE-2026-32201 and CVE-2026-45659 vulnerabilities.
However, there are no details on how many of them are vulnerable to CVE-2026-56164 attacks or are honeypots.
CISA urged security teams to closely monitor affected servers for signs of exploitation and recommended applying Microsoft’s latest patches, verifying successful installation, shortening patching cycles, as well as enabling Windows Antimalware Scan Interface (AMSI integration for SharePoint web applications and using Microsoft Defender Antivirus (MDAV) detections to detect and remediate compromise.
Additional hardening measures include hunting for and remediating intrusion artifacts before rotating IIS machine keys, establishing tailored logging to monitor for anomalous activity, avoiding direct internet exposure of SharePoint servers unless necessary, and reviewing Microsoft’s official SharePoint Server security-hardening guidance.
It is also advisable to block external access to SharePoint Central Administration and restrict farm and database communication to the required systems. Where exposure is required, CISA also recommends placing servers behind a Layer 7 reverse proxy or similar application-layer security control.
CISA added the three actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog on April 14 (CVE-2026-32201), July 1 (CVE-2026-45659), and July 14 (CVE-2026-56164).
Federal agencies have until July 17 to secure SharePoint servers affected by CVE-2026-56164 under Binding Operational Directive (BOD) 26-04 or discontinue them if mitigations cannot be applied.
In total, since November 2021, CISA has flagged 11 Microsoft SharePoint vulnerabilities that have been exploited in attacks, with 7 also exploited in ransomware attacks.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
CISA: Microsoft SharePoint RCE flaw now actively exploited
CISA orders feds to patch exploited Ivanti EPMM flaw by Saturday
CISA gives feds three days to patch Ivanti flaw exploited as zero-day
CISA warns of actively exploited RCE flaws in Joomla extensions
CISA orders feds to prioritize patching Langflow auth bypass flaw
Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days
Claude Fable 5 stays free for paid users until July 19 as Anthropic buys more time
OpenAI temporarily relaxes GPT-5.6 Sol usage limits
AI broke vulnerability management. Get the guide CISOs use to shift budget to BAS.
#1 MSP Benchmark report 2026: Insights from 1,000+ MSPs on growth, security, artificial intelligence, and key 2026 trends.
How Mature Is Your AI Security Program? Take the Free AI Maturity Assessment.
AI is a data-breach time bomb: Read the new report
Overdue a password health-check? Audit your Active Directory for free
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
