Microsoft SharePoint Server flaws are being actively exploited to gain remote code execution, install persistent web shells, and steal cryptographic keys from exposed systems.
The attacks put on-premises SharePoint deployments at risk of data theft, network compromise, ransomware, and prolonged unauthorized access.
The issue affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016.
Attackers can chain authentication bypass, unsafe data processing, and input-validation flaws to turn an internet-facing collaboration server into an entry point for the wider corporate network.
Researchers at Resecurity identified that the campaign can move quickly from a crafted web request to deeper compromise of SharePoint, IIS, SQL Server, and Active Directory-connected resources.
Resecurity said in a report shared with Cyber Security News (CSN) that stolen IIS machine keys can help attackers retain access even after the initial vulnerability is patched.
The activity follows growing concern around public-facing SharePoint infrastructure, where a single vulnerable server may contain sensitive documents and hold trusted connections to other business systems.
Readers can also review earlier SharePoint server RCE coverage for background on the deserialization weakness affecting the platform.
Microsoft SharePoint Vulnerabilities
The actively exploited flaws include CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, which have been added to CISA’s Known Exploited Vulnerabilities catalog.
CVE-2026-45659 allows a site member to execute code remotely, while CVE-2026-56164 can let an unauthenticated attacker reach a critical function without proper authentication.
After gaining code execution, attackers can place a web shell on the SharePoint server and use it to run commands, upload files, or maintain access.
.webp)
This approach resembles other web shell attacks against IIS, where a compromised web server becomes a quiet and durable foothold inside an organization.
A particularly serious step is theft of the ASP.NET machineKey values held in SharePoint configuration files.
Those keys are used to protect application data, and their theft may allow an attacker to create trusted-looking ViewState data or authentication material, helping them preserve access after a web shell is removed.
The report also warns that attackers may add malicious IIS modules that load with worker processes and survive restarts.
Once inside a SharePoint farm, the compromised service account could be used to access databases, find additional credentials, and move toward domain resources or other internal systems.
Patching and Threat Hunting
Organizations should immediately apply Microsoft’s July 2026 SharePoint security updates across every server in the farm and confirm that the updated builds are installed.
The report also recommends treating unpatched, internet-exposed SharePoint servers as high-priority systems for incident response and threat hunting.
Administrators should enable AMSI integration for every web application and use Full Request Body Scan mode where practical.
Restricting direct internet exposure, placing external services behind an authenticated inspection layer, limiting database communication, and blocking access to Central Administration can reduce the chance that one compromised server becomes a larger breach.
.webp)
Defenders should review IIS, Windows Event, and SharePoint ULS logs for unusual requests, unexpected new files, suspicious process launches from IIS worker processes, and changes to IIS modules or machine-key settings.
CISA’s catalog status matters because it reflects confirmed exploitation, as covered in this CISA KEV catalog expansion report.
If compromise is suspected, teams should isolate affected servers, remove persistence mechanisms, investigate all farm members, and reset relevant service-account credentials.
IIS machine keys should be rotated only after responders are confident the environment is clean, because rotating them too early can allow an intruder to retain other forms of access.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Web shell file name | spinstall0.aspx | Web shell identified in the source as used to extract machineKey material from web.config. |
| Suspicious endpoint | /_layouts/15/ToolPane.aspx | POST requests with edit display mode were listed as an initial-access hunting indicator. |
| Suspicious endpoint | /_layouts/16/ToolPane.aspx | POST requests with edit display mode were listed as an initial-access hunting indicator. |
| Spoofed referer path | /_layouts/SignOut.aspx | Referer value associated with attempts to bypass controls or reach privileged endpoints. |
| Process | w3wp.exe | IIS worker process; suspicious when spawning command shells, PowerShell, or compilers. |
| Process | cmd.exe | Child process of w3wp.exe highlighted as suspicious activity. |
| Process | powershell.exe | Child process of w3wp.exe highlighted as suspicious activity. |
| Process | csc.exe | Child process of w3wp.exe highlighted as suspicious activity. |
| Persistence artifact | FarmAuthNative.dll | Unauthorized native IIS module named in the report’s hypothetical breach simulation. |
| Cookie name | FarmAuth | Cookie value used to trigger the hypothetical malicious IIS module. |
| Handler endpoint | AssetHandler.axd | ASP.NET handler endpoint used in the report’s hypothetical breach simulation. |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
