The US Cybersecurity and Infrastructure Safety Company (CISA) warned on Tuesday that attackers are actively exploiting three vulnerabilities to hack on-premises SharePoint Server situations uncovered to the web.
These safety flaws (tracked as CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164) have an effect on all supported self-hosted SharePoint Server variations, together with SharePoint Server subscription editions (newest on-premises variations that use the “steady replace” mannequin).
As detailed in Tuesday’s advisory, attackers are exploiting these vulnerabilities to bypass authentication, remotely execute code, steal Web Info Companies machine keys, and acquire persistence to deploy malware on compromised techniques, amongst different post-exploitation actions.
The US cybersecurity company additionally flagged two extra vulnerabilities in SharePoint Server (CVE-2026-55040 and CVE-2026-58644), which Microsoft patched on Tuesday and tagged as engaging targets for attackers, though it isn’t but recognized whether or not they have been exploited within the wild.
Web safety monitoring group Shadowserver at present tracks almost 10,000 Microsoft SharePoint servers uncovered to the Web, and greater than 800 of them are unpatched for the CVE-2026-32201 and CVE-2026-45659 vulnerabilities.
Nonetheless, there aren’t any particulars on what number of of them are susceptible to CVE-2026-56164 assaults or are honeypots.
CISA urged safety groups to carefully monitor affected servers for indicators of exploitation, and really useful making use of the most recent Microsoft patches, verifying profitable installations, shortening patching cycles, and enabling the Home windows Antimalware Scan Interface, which makes use of AMSI integration for SharePoint net purposes and Microsoft Defender Antivirus (MDAV) detection to detect and remediate compromises.
Extra hardening measures embody detecting and remediating intrusion artifacts earlier than rotating IIS machine keys, establishing tailor-made logging to watch for anomalous exercise, avoiding exposing SharePoint servers on to the Web until crucial, and reviewing Microsoft’s official SharePoint Server safety hardening steerage.
We additionally suggest that you just block exterior entry to SharePoint Central Administration and restrict farm and database communication to the techniques that require it. If publicity is required, CISA additionally recommends inserting the server behind a Layer 7 reverse proxy or comparable application-layer safety management.
CISA added three at present exploited vulnerabilities to its recognized exploited vulnerabilities catalog on April 14 (CVE-2026-32201), July 1 (CVE-2026-45659), and July 14 (CVE-2026-56164).
Federal companies have till July seventeenth to guard SharePoint servers affected by CVE-2026-56164 below Binding Working Order (BOD) 26-04, or shut them down if mitigations can’t be utilized.
Since November 2021, CISA has reported {that a} whole of 11 Microsoft SharePoint vulnerabilities have been exploited in assaults, seven of which have additionally been exploited in ransomware assaults.
Safety groups doc 54% of profitable assaults and difficulty a warning on solely 14%. The remaining strikes invisibly by way of the atmosphere.
Picus’ whitepaper reveals the best way to check your SIEM and EDR guidelines in breach and assault simulations to make sure threats go undetected.
Get the white paper
