CISA has issued an urgent advisory regarding multiple actively exploited vulnerabilities in Microsoft SharePoint Server, including two zero-day flaws. The most recent is CVE-2026-56164, a remote, unauthenticated privilege escalation vulnerability patched in July 2026. Other critical vulnerabilities include CVE-2026-55040 and CVE-2026-58644, which allow remote code execution and security feature bypass, patched in the same update. Additionally, CVE-2026-32201 (spoofing) and CVE-2026-45659 (code execution) were previously exploited and patched in April and May 2026, respectively. These vulnerabilities affect all supported on-premises SharePoint Server versions and enable attackers to execute remote code, steal IIS machine keys, and maintain persistence through deserialization techniques. CISA has added several of these to its Known Exploited Vulnerabilities catalog and recommends immediate patching and enhanced monitoring to prevent exploitation.

Successful exploitation of these vulnerabilities allows remote attackers to execute arbitrary code, escalate privileges without authentication, bypass security features, and maintain persistence on affected SharePoint servers. This can lead to unauthorized access, deployment of malware, and compromise of critical infrastructure components such as IIS machine keys. The vulnerabilities affect all supported on-premises SharePoint Server versions, potentially impacting a wide range of organizations relying on these platforms.

Microsoft has released official patches for all identified vulnerabilities in its April, May, and July 2026 security updates. CISA strongly urges immediate application of these patches, especially CVE-2026-56164, which is listed in the Known Exploited Vulnerabilities catalog with a three-day patching deadline for federal agencies. Organizations should also monitor SharePoint servers for unusual activity, rotate IIS machine keys, enable tailored logging, restrict direct internet exposure of SharePoint servers, and limit access to administration interfaces. Security products should be configured to cover all SharePoint web applications and support intrusion hunting. These combined measures help mitigate exploitation risks effectively.