Adversary Intelligence — 2026-07-17

CISA Warns of Active Nation-State Exploitation of Microsoft SharePoint Server Vulnerabilities

BLUFStolen IIS machine keys grant persistent access that survives patching, so organizations likely face residual compromise even after Microsoft addresses CVE-2026-55040 by August 11.

CISA warned on July 14 that threat actors are actively exploiting four on-premises SharePoint Server vulnerabilities, CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644, using remote code execution and deserialization to steal IIS machine keys and deploy malware 1. CISA updated the alert on July 16 to add CVE-2026-58644 to its Known Exploited Vulnerabilities catalog, and The Register reported the flaws remained exploitable despite earlier Microsoft patches 12. Cybersecurity Dive reported that CVE-2026-45659 carries a severity score of 8.8 and that CVE-2026-56164, which allows privilege escalation, was newly disclosed on Tuesday 3. Rapid7 identified a fifth flaw, CVE-2026-55040, a JWT authentication-bypass vulnerability that Microsoft patched on July 14, which can be chained with a second, still-unnumbered remote code execution flaw for unauthenticated RCE. Rapid7 said a fix for that companion vulnerability is not expected until Microsoft's August update cycle 3.

Analysis
Microsoft will likely ship a fix for CVE-2026-55040 by the August 11 Patch Tuesday, leaving a roughly four-week window in which the authentication-bypass flaw remains chainable with the four already-exploited SharePoint vulnerabilities for remote code execution. Until then, on-premises SharePoint farms exposed to the internet face compounding risk. IIS machine-key theft enables persistence even after individual CVEs are patched, since stolen keys can forge authentication tokens without triggering new exploitation signatures. Moderate confidence rests on Microsoft's stated intent to fix a disclosed vulnerability inside its standard monthly cycle, tempered by the absence of a committed release date. CISA's mid-alert addition of a fourth CVE to its Known Exploited Vulnerabilities catalog signals the exploitation set is still expanding, not converging.
4 sources
  1. CISA Urges SharePoint Hardening After New Exploitations
  2. CISA sounds alarm over trio of exploited SharePoint flaws - The Register
  3. CISA warns that multiple vulnerabilities in SharePoint are under exploitation - Cybersecurity Dive
  4. CISA Urges Immediate Patching of Exploited SharePoint Vulnerabilities - SecurityWeek

View in full brief →

UNCLASSIFIED // OPEN SOURCE