Multiple vulnerabilities affecting Microsoft SharePoint Server have been identified and are currently being actively exploited in the wild. These vulnerabilities include remote code execution (RCE), authentication bypass, and privilege escalation flaws that can be chained by attackers to gain unauthorized access and execute arbitrary code on affected systems. CVE-2026-58644[1]: This vulnerability is critical a deserialization flaw that allows an attacker authenticated with sufficient privileges to execute arbitrary code remotely on affected SharePoint servers. It impacts SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. According to CISA, this vulnerability has been exploited in the wild prior to patch availability and has been added to the KEV catalog, highlighting its critical risk to organizations using affected versions. CVE-2026-45659[2]: This vulnerability enables remote code execution and has been exploited in attacks targeting SharePoint servers. Threat actors are leveraging this flaw as part of a broader exploitation chain to gain access and execute arbitrary code on affected systems. CVE-2026-32201[2]: This vulnerability is a spoofing-related issue that can be used as part of an attack chain to bypass authentication and facilitate further exploitation. It has previously been exploited as a zero-day and continues to be referenced in current campaigns targeting SharePoint deployments. CVE-2026-56164[3]: This vulnerability is a privilege escalation issue that can be exploited remotely, in some cases without authentication, allowing attackers to elevate their privileges on vulnerable SharePoint servers. Microsoft describes the underlying weakness as missing authentication for a critical function. It has been observed in active attack scenarios and is referenced by CISA as one of the vulnerabilities currently being exploited against internet-exposed environments.

CVE

CVE-2026-58644 – CVSS 3.1: 9.8

CVE-2026-45659 – CVSS 3.1: 8.8

CVE-2026-32201 – CVSS 3.1: 6.5

CVE-2026-56164 – CVSS 3.1: 5.3

Affected Products

All of the above mentioned vulnerabilities affects[1][2]: Microsoft SharePoint Server Subscription Edition Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016

Exploitation

All of the vulnerabilities has been added to CISA’s Known Exploited Vulnerabilities catalog[4][5].

Threat Actor

Unknown

Recommended Actions

Truesec recommends following CISA’s hardening measures[6]: – Apply the latest patches and security updates from Microsoft, verify they have been installed successfully, and shorten patching cycles when possible. – Verify that Antimalware Scan Interface (AMSI) integration is enabled for each SharePoint web application. – Scan for and remove intrusion artifacts, including machine key harvesting tools, before rotating IIS machine keys to avoid the theft of the keys. – Establish tailored logging mechanisms to detect and monitor exploitation activities. – Avoid exposing SharePoint Servers directly to the internet unless necessary. – Block external access to SharePoint Central Administration, restrict farm and database communications to required systems, and review Microsoft’s SharePoint Server security-hardening guidance for role-specific ports, services, and Web.config settings. The SharePoint Server security-hardening guidance can be found here: https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/security-hardening

Detection

If Antimalware Scan Interface (AMSI) integration is enabled for your SharePoint web applications, with the “Full Mode” option for the Request Body Scan Mode enabled[6]. These are the following AMSI and Microsoft Defender Antivirus (MDAV) detections that cover exploitation of these vulnerabilities. – AMSI: Exploit:Script/SuspSignoutReqBody.A – request body scanning; SharePoint Server Subscription only; Microsoft has blocked observed attempts. – AMSI: Exploit:Script/ToolPaneAuthBypass.A – request header scanning; SharePoint Server 2016, 2019, and Subscription Edition. – AMSI: Exploit:Script/ToolPaneAuthBypass.C – RCE coverage; SharePoint Server 2016, 2019, and Subscription Edition. – MDAV: Backdoor:MSIL/LeakFang.A!dha – post-exploitation activity alert involving IIS-protected secrets.

References

[1] https://thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html [2] https://www.securityweek.com/cisa-urges-immediate-patching-of-exploited-sharepoint-vulnerabilities/ [3] https://windowsforum.com/threads/july-2026-patch-tuesday-fixes-2-exploited-zero-days.438195/ [4] https://www.cisa.gov/news-events/alerts/2026/07/16/cisa-adds-three-known-exploited-vulnerabilities-catalog [5] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644 [6] https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations