Loading story…
Attackers are reportedly exploiting vulnerabilities in on-premises Microsoft SharePoint Server to gain unauthorized access, execute code, and establish persistence. Resecurity describes six flaws affecting SharePoint Server Subscription Edition, 2019, and 2016, and reports active exploitation and CISA Known Exploited Vulnerabilities catalog inclusion for CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644. SharePoint Online and Microsoft 365 are reportedly unaffected. Previdian identifies CVE-2026-45659 as an untrusted-data deserialization vulnerability patched in May, and separately reports exploitation of CVE-2026-50522 following July security updates. However, conflicting advisories describe different mechanisms and severity scores for CVE-2026-50522, warranting validation against Microsoft's authoritative guidance.
Reported attacker activity includes deploying web shells, stealing ASP.NET machine keys, and maintaining access through forged ViewState payloads or malicious IIS modules. Patching alone may not eliminate an existing compromise, because stolen keys and implanted persistence can survive updates. Organizations should patch every SharePoint farm server, investigate for web shells and malicious modules, rotate machine keys after cleanup, and rotate affected credentials. Additional recommended defenses include enabling AMSI request-body scanning and restricting network exposure. The reports do not attribute the activity to a specific threat group; Resecurity's illustrative domain-compromise scenario is explicitly fictional, not evidence of an actual breach.
See which actors are running it and whether you're in range.
13 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-58644 to its Known Exploited Vulnerabilities Catalog after Microsoft confirmed active exploitation. The flaw permits unauthenticated remote code execution through deserialization of untrusted data.
CISA added CVE-2026-56164 to its exploited-vulnerability catalog and issued an advisory reporting exploitation of CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164. The advisory described unauthorized access, remote code execution, IIS machine-key theft, and persistence through deserialization techniques.
Microsoft published fixes for CVE-2026-56164, CVE-2026-55040, CVE-2026-58644, and CVE-2026-50522. The vulnerabilities affect on-premises SharePoint Server rather than SharePoint Online or Microsoft 365.
CISA added the SharePoint deserialization vulnerability CVE-2026-45659 to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation.
Microsoft released updates addressing CVE-2026-45659, a deserialization vulnerability that allows an authenticated SharePoint Site Member to execute code remotely.
CISA listed the SharePoint spoofing vulnerability CVE-2026-32201 in its Known Exploited Vulnerabilities Catalog, reflecting confirmed exploitation.
The Resecurity report credits Rapid7 with discovering a two-vulnerability unauthenticated remote code execution chain involving CVE-2026-55040. It does not specify when the discovery occurred.
CERT-EU reported that watchTowr observed active exploitation after identifying proof-of-concept code on July 20. The supplied content does not specify the date of that subsequent observation.
CERT-EU updated its SharePoint advisory, placing CVE-2026-50522 within the ongoing series of actively exploited on-premises vulnerabilities. It strongly recommended immediate updates and credential rotation for affected assets.
CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation.
BleepingComputer reported that attackers were exploiting CVE-2026-50522 to steal SharePoint machine keys. The stolen keys could let attackers retain access after servers were patched.
According to CERT-EU, watchTowr identified public proof-of-concept exploit code for CVE-2026-50522, an unauthenticated SharePoint remote code execution vulnerability.
Zero Day Initiative published ZDI-26-412 and ZDI-26-413, describing unauthenticated SharePoint remote code execution through deserialization and improper cryptographic signature verification, respectively. Both excerpts assign CVE-2026-50522 a score of 8.1, conflicting with the 9.8 score reported elsewhere in the supplied content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
resecurity.com
Open sourceprevidian.com
Open sourceprevidian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical Microsoft SharePoint remote code execution flaw, **CVE-2026-50522** (`CVSS 9.8`), is being actively exploited against on-premises deployments after Microsoft released fixes for affected versions of **SharePoint Enterprise Server 2016**, **SharePoint Server 2019**, and **SharePoint Subscription Edition**. The vulnerability stems from unsafe deserialization of untrusted data and can be triggered through unauthenticated requests, making internet-facing SharePoint farms particularly exposed. Researchers reported likely real-world exploitation against honeypots, and public proof-of-concept code is now available. Reporting indicates attackers have targeted on-prem SharePoint instances and, in some cases, stolen machine keys to help preserve long-term access. The flaw was originally demonstrated during **Pwn2Own Berlin**, where exploit code was shown and shared with Microsoft before the vendor issued patches. Organizations running exposed SharePoint servers have been urged to apply the fixed versions immediately and, if patching cannot be completed at once, restrict external access and review logs for suspicious requests to SharePoint sign-in pages.
Aug 25, 2026
CISA and Microsoft warned that multiple **on-premises SharePoint Server** vulnerabilities are being actively exploited against internet-facing systems, with attackers using a chain involving `CVE-2026-32201`, `CVE-2026-45659`, and `CVE-2026-56164` to gain unauthorized access, execute code, steal IIS and ASP.NET machine keys, maintain persistence, and deploy malware. The agencies said the activity affects supported on-premises SharePoint deployments rather than SharePoint Online, and follows earlier Microsoft reporting that Chinese threat actors including **Linen Typhoon**, **Violet Typhoon**, and **Storm-2603** had abused similar SharePoint flaws to install web shells, dump credentials, move laterally, and in some cases deploy **Warlock ransomware**. Microsoft’s July 2026 updates also fixed two additional critical SharePoint bugs, `CVE-2026-55040` and `CVE-2026-58644`, which were not yet confirmed as exploited but were assessed as likely targets for rapid weaponization, while separate reporting said another SharePoint exploit chain may remain unpatched pending a later release. Defenders were urged to immediately apply available patches, enable **AMSI** in Full Mode, reduce or remove internet exposure, restrict access to SharePoint Central Administration, review logs and endpoint telemetry for compromise, and only rotate IIS or ASP.NET machine keys after confirming whether intrusion activity is already present.
Aug 27, 2026
Microsoft released security updates for **SharePoint Server Subscription Edition**, **SharePoint Server 2019**, and **SharePoint Server 2016**, including corresponding language pack updates, to address actively exploited SharePoint vulnerabilities. The flaws include **`CVE-2025-53770`**, a critical unauthenticated remote code execution issue caused by unsafe deserialization of untrusted data, and **`CVE-2025-53771`**, a spoofing flaw tied to improper path validation for sensitive files; reporting linked their exploitation to the **ToolShell** campaign targeting government, academic, and energy organizations worldwide. Microsoft published update packages including **`KB5002768`** for Subscription Edition, **`KB5002754`** and **`KB5002753`** for SharePoint 2019 core and language pack, and **`KB5002760`** and **`KB5002759`** for SharePoint 2016 and its language pack. U.S. CISA also added a critical SharePoint deserialization flaw, **`CVE-2026-50522`**, to its **Known Exploited Vulnerabilities** catalog after public proof-of-concept code and reports of active attacks. According to the advisory, attackers have stolen SharePoint machine keys to preserve access even after patching, prompting guidance to patch immediately, rotate potentially exposed credentials and cryptographic material, enable protections such as **AMSI** and **Microsoft Defender AV**, and investigate systems for indicators of compromise including webshells, suspicious files, malicious URLs, paths, and IP addresses.
Aug 10, 2026