Glossary term
Known Exploited Vulnerabilities (KEV) catalog
The Known Exploited Vulnerabilities (KEV) catalog is a list of vulnerabilities that have been exploited in real attacks.
Read more
Significant cyber incident
SharePoint on-premises exploitation wave of 2026
Between March and September 2026, CISA added eight Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
In short
Between March and September 2026, CISA added eight Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. Its main alert warns that attackers use them for remote code execution on on-premises SharePoint Server 2016, 2019 and Subscription Edition, then steal IIS machine keys and use deserialization to stay in and deploy malware. The newest listing was added on 25 September 2026.
What happened
In 2026 CISA added eight SharePoint flaws to its Known Exploited Vulnerabilities catalog, one at a time, from 18 March to 25 September. In an alert dated 14 July 2026 and updated until 26 August, CISA said six of them were being used to gain unauthorized access to on-premises SharePoint Server.
The alert says the flaws affect all supported on-premises versions (Subscription Edition, 2019 and 2016). It names remote code execution, theft of IIS machine keys and deserialization as the methods used to gain persistence and deploy malware.
On 25 September 2026 CISA added an eighth SharePoint flaw, CVE-2026-65660. Public sources do not name victims, a count of affected servers or an actor.
Timeline
-
2026-01-13
Microsoft publishes CVE-2026-20963 (deserialization, remote code execution)
-
2026-03-18
CISA adds CVE-2026-20963 to the KEV catalog
-
2026-04-14
CISA adds CVE-2026-32201 (spoofing) to KEV; Microsoft's record says exploitation detected
-
2026-05-21
Microsoft publishes CVE-2026-45659 in its May 2026 release
-
2026-06-10
CISA issues BOD 26-04 on risk-based patching
-
2026-07-01
CISA adds CVE-2026-45659 to KEV; the entry marks known ransomware campaign use
-
2026-07-14
Microsoft publishes CVE-2026-56164, CVE-2026-58644, CVE-2026-50522 and CVE-2026-55040; CISA adds CVE-2026-56164 to KEV and issues its SharePoint hardening alert
-
2026-07-16
CISA adds CVE-2026-58644 to KEV and updates the alert
-
2026-07-22
CISA adds CVE-2026-50522 to KEV (alert updated 28 July)
-
2026-08-11
Microsoft publishes CVE-2026-65660 (code injection)
-
2026-08-18
CISA adds CVE-2026-55040 to KEV and updates the alert
-
2026-08-26
CISA updates the alert to clarify advice on not exposing SharePoint to the internet
-
2026-09-25
CISA adds CVE-2026-65660 to KEV; Microsoft notes reliable evidence of observed attacks
How the attack worked
Several flaws, one product
The eight flaws are different bugs in the same product. Microsoft and CISA describe them as deserialization of untrusted data (CVE-2026-20963, CVE-2026-45659, CVE-2026-58644, CVE-2026-50522), missing authentication (CVE-2026-56164), weak authentication (CVE-2026-55040), improper input validation leading to spoofing (CVE-2026-32201) and code injection (CVE-2026-65660). Some need no login. CVE-2026-45659 and CVE-2026-65660 are described as needing an authorized attacker.
What CISA says attackers do after getting in
CISA says the flaws involve remote code execution, then post-exploitation such as stealing Internet Information Services (IIS) machine keys and performing deserialization techniques, to gain persistence and deploy malware. Machine keys protect ASP.NET view state. If they leak, rotating them without removing the intruder’s tools can let the keys be stolen again, so CISA says to hunt first and rotate second.
Detections CISA names
CISA lists AMSI detections for request-header and request-body exploit attempts and a Defender detection for a post-exploitation backdoor touching IIS-protected secrets. These are detection names, not malware families confirmed by a public report. No source here lists ATT&CK technique ids, so none are given.
Who says who was behind it
No public attribution. The CISA alert of 14 July 2026 (updated to 26 August 2026) and the 25 September 2026 KEV alert name no actor, victim or campaign owner. CISA only says "cyber threat actors" gain access. Sources differ on scope: the CISA alert covers six CVEs, while the KEV feed lists eight SharePoint entries added in 2026. The two extra ones are CVE-2026-20963 (added 18 March 2026) and CVE-2026-65660 (added 25 September 2026). Microsoft's record for CVE-2026-45659 showed no exploitation flag when read, while CISA lists it as exploited.
Malware and vulnerabilities used
Impact
Sources give no victim list, no count of compromised servers and no data-loss figures.
CISA says the flaws let attackers gain unauthorized access to on-premises SharePoint Server, with remote code execution, theft of IIS machine keys, persistence and malware deployment.
The KEV feed marks CVE-2026-45659 as known ransomware campaign use. The other SharePoint entries are marked unknown.
All supported on-premises versions are affected: Subscription Edition, 2019 and 2016.
Federal agencies were given short KEV deadlines (the feed shows three days for the newer entries, for example 2026-09-28 for CVE-2026-65660).
Government and regulator response
- 10 June 2026: CISA issued BOD 26-04, requiring federal civilian agencies to prioritize fast fixes for flaws in the KEV catalog.
- 14 July 2026: CISA published its SharePoint hardening alert with Microsoft’s contribution. It was updated on 16 July, 28 July, 18 August and 26 August.
- CISA advice: do not expose SharePoint directly to the internet, use a Layer 7 reverse proxy if exposure is needed, patch quickly, enable AMSI with Full Mode request body scanning where feasible, hunt before rotating machine keys, block external access to Central Administration, and review telemetry for webshells and machine-key access.
- Microsoft: released security updates for each CVE. For CVE-2026-58644 it said the fix was released but the CVE was left out of the June 2026 notes. On 25 September 2026 it recorded evidence of observed attacks for CVE-2026-65660.
- 25 September 2026: CISA added CVE-2026-65660 to the KEV catalog.
Lessons
-
Exploitation arrives in waves
CISA's alert grew from three to six CVEs between April and August 2026, and a further SharePoint flaw was added in September. One patch cycle does not close the product's exposure.
-
Do not leave SharePoint on the open internet
CISA's first advice is to avoid direct internet exposure, and from 26 August 2026 it stresses an authenticating application-layer proxy if exposure cannot be avoided.
-
Patching is not the end
CISA describes theft of IIS machine keys for persistence. Keys stolen before a patch still matter after it.
-
Order matters when rotating keys
CISA says to hunt for machine-key harvesters before rotating keys, or the new keys can be stolen again.
-
Turn on the built-in scanning
CISA asks for AMSI integration on every web application and names detections to alert on.
-
Release notes can miss a fix
Microsoft said CVE-2026-58644's fix shipped but the CVE was left out of the June 2026 notes. Track CVEs from more than one list.
What to check in your own organization
-
Find every SharePoint server
List all on-premises SharePoint servers (2016, 2019, Subscription Edition), including old test farms, and note which can be reached from the internet.
-
Confirm patch level for all eight CVEs
Check each server against Microsoft's records for CVE-2026-20963, CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522, CVE-2026-55040 and CVE-2026-65660.
-
Remove direct exposure
Put an authenticating Layer 7 reverse proxy in front of any server that must be reachable, and block external access to Central Administration.
-
AMSI and detections
Check AMSI is on for each web application, with Full Mode request body scanning where feasible, and that alerts for the detections CISA names reach your SOC.
-
Hunt before rotating keys
Look for webshells, odd worker-process activity and machine-key access first. Then rotate IIS machine keys.
-
Logging
Confirm SharePoint and IIS logs are kept and searchable for the months since March 2026.
-
Early warning
Threat intelligence monitoring can watch for new vulnerability alerts and KEV additions for products you run, so a SharePoint listing prompts a check the same day. It can also watch for exposed credentials or leaked keys tied to your domains. This lowers the chance of learning late. It does not promise detection.
Questions
Which SharePoint CVEs does CISA list as exploited in 2026?
The KEV feed lists eight: CVE-2026-20963 (18 March), CVE-2026-32201 (14 April), CVE-2026-45659 (1 July), CVE-2026-56164 (14 July), CVE-2026-58644 (16 July), CVE-2026-50522 (22 July), CVE-2026-55040 (18 August) and CVE-2026-65660 (25 September).
Which of them are in CISA's hardening alert?
Six: CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522 and CVE-2026-55040. CVE-2026-20963 and CVE-2026-65660 are in the KEV catalog but not in that alert's list.
Is this the same as ToolShell?
No. ToolShell was the 2025 case. This page covers 2026 flaws. CISA's alert links back to its 2025 SharePoint guidance.
Which versions are affected?
CISA says all supported on-premises versions: Subscription Edition, 2019 and 2016.
Who is behind it?
No public attribution. CISA names no actor.
What should we do first?
Follow CISA's advice: avoid direct internet exposure, apply Microsoft's updates, enable AMSI, and hunt for intrusion artifacts before rotating IIS machine keys.
Sources
- CISA Urges SharePoint Hardening After New Exploitations CISA
- CISA Adds Two Known Exploited Vulnerabilities to Catalog (25 September 2026) CISA
- CISA Catalog of Known Exploited Vulnerabilities (JSON feed) CISA
- BOD 26-04: Prioritizing Security Updates Based on Risk CISA
- Microsoft Security Update Guide, CVE-2026-65660 Microsoft (MSRC)
- Microsoft Security Update Guide, CVE-2026-58644 Microsoft (MSRC)
- Microsoft Security Update Guide, CVE-2026-32201 Microsoft (MSRC)
- Microsoft Security Update Guide, CVE-2026-20963 Microsoft (MSRC)
- NVD record, CVE-2026-65660 NIST NVD
- NVD record, CVE-2026-55040 NIST NVD
- Improved ASP.NET view state security and key management Microsoft Learn
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.