SharePoint zero-day: On-prem servers under active attack

On July 14, 2026, Microsoft shipped the largest Patch Tuesday in its history, a record 622 CVEs, and buried inside it were two vulnerabilities already under active attack. The most serious, CVE-2026-56164, is an unauthenticated elevation-of-privilege flaw in on-premises SharePoint Server that requires no credentials, no user interaction, and only a single network request to exploit. The same day, CISA added it to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate within 72 hours.

The flaw is dangerous out of proportion to its official rating. Microsoft assigned CVE-2026-56164 a modest CVSS score of 5.3, but the National Vulnerability Database scored the same bug 9.8. On a pre-authentication, zero-click vulnerability being weaponised in the wild, the lower number badly understates the risk. Attackers are chaining it with two other SharePoint flaws to steal server secrets, plant persistent backdoors, and deploy malware, the same playbook that drove the "ToolShell" mass-compromise of July 2025.

What happened

CVE-2026-56164 is a missing-authentication vulnerability: a critical SharePoint function that should require a valid, privileged session can be reached by an anonymous attacker over the network. Exploitation grants elevated privileges on the server without any account. Microsoft credited its discovery to incident responders at Mandiant and Google's FLARE team, an attribution that, as with the July 2025 flaws, signals it was uncovered while investigating live intrusions rather than through routine research.

It affects every supported on-premises build: SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. SharePoint Online in Microsoft 365 is not affected. In practice, an at-risk asset is any internet-facing on-premises SharePoint farm, and the internet is full of them. The Shadowserver Foundation tracks roughly 10,000 internet-exposed SharePoint servers, with hundreds still unpatched days after the fix shipped.

The exploit chain

CVE-2026-56164 is rarely used alone. Attackers combine it with two companion flaws patched the same day: CVE-2026-32201, a spoofing vulnerability (CVSS 6.5) that an unauthenticated attacker can trigger over the network, and CVE-2026-45659, a deserialization remote-code-execution bug (CVSS 8.8) that had already been added to CISA's KEV catalog earlier in July after separate exploitation.

Chained together, the sequence is devastating. The missing-authentication flaw provides anonymous access; from there the attacker extracts the server's ASP.NET machine keys, the cryptographic secrets (validationKey and decryptionKey) that SharePoint uses to sign and encrypt __VIEWSTATE data. With the machine keys in hand, an attacker can forge trusted, signed payloads that the server deserialises and executes, turning the deserialization bug into reliable remote code execution. The result is a full compromise: webshells, IIS module backdoors, and malware planted across the farm.

The theft of machine keys is what makes this so persistent. Once an attacker has copied a server's keys, they can forge valid requests indefinitely, even after the July patch is applied. Patching closes the front door, but it does not rotate the keys the intruder already stole. Any server exploited before patching must have its machine keys rotated to evict the attacker.

The second zero-day: Active Directory Federation Services

The July 14 release also patched a second actively exploited zero-day, CVE-2026-56155, in Active Directory Federation Services (AD FS). It is an elevation-of-privilege flaw: an attacker with low-level local access can escalate to administrative control over the AD FS server through weak access controls. Microsoft credited the find to its own Detection and Response Team (DART), again pointing to discovery during active-incident investigation.

AD FS sits at the heart of enterprise identity, issuing the authentication tokens that federate access to cloud and on-premises applications. Administrative control over AD FS lets an attacker forge tokens and impersonate any user, making it a high-value target for the same actors who breach SharePoint. CISA set a slightly longer remediation deadline for this flaw, July 28, but for any organisation running AD FS it is no less urgent.

How attacks like this unfold

The pattern is a near-replay of ToolShell. An attacker scans for internet-facing SharePoint servers and fingerprints their version. A single crafted request abuses the missing-authentication flaw to reach a privileged function and pull the server's machine keys. Automated tooling handles this at scale, sweeping thousands of exposed farms within hours of a working exploit becoming available.

With keys in hand, the attacker forges a malicious __VIEWSTATE payload that the server deserialises, executing code as the SharePoint service account. They typically drop a webshell, in the 2025 campaign a file named spinstall0.aspx that harvested the keys was the signature, establish persistence through scheduled tasks or malicious IIS modules, and move laterally into connected file shares, databases, and identity systems.

Post-exploitation diverges by motive. In July 2025, Microsoft attributed the ToolShell wave to Chinese nation-state groups Linen Typhoon and Violet Typhoon for espionage, and to a third actor, Storm-2603, which deployed Warlock ransomware. Microsoft has not yet publicly attributed the 2026 activity or detailed the full chain, but the technical fingerprint, machine-key theft, ViewState forgery, and webshell persistence, is unmistakably the same.

Why leaders should care

SharePoint is where organisations keep their institutional memory: contracts, HR records, financials, engineering documents, and the credentials embedded in workflows and integrations. A compromised on-premises farm hands attackers not just files but a foothold connected to Active Directory, Office integrations, and internal services. Because the exploit needs no credentials and no user interaction, there is no phishing step to block and no user to blame.

The July 2025 precedent shows how fast this escalates. Within days of ToolShell's disclosure, more than 400 organisations were compromised, including government agencies, before many defenders had patched. The 2026 flaws are being exploited on the same kind of timeline, and the machine-key persistence problem means that "we patched" is not the same as "we are safe." Regulatory exposure under GDPR, HIPAA, and sector-specific frameworks attaches the moment attacker access reaches personal, health, or payment data stored in SharePoint.

For security leaders, the uncomfortable question is whether an internet-facing SharePoint server was compromised during the exploitation window, before the patch, or after the patch but without key rotation. Answering it requires forensic investigation, not an inventory check.

What to do now

1. Apply the July 14, 2026 updates immediately

   Install the SharePoint security updates released on July 14 across all on-premises 2016, 2019, and Subscription Edition builds, and apply the AD FS update for CVE-2026-56155. Verify that the installed build number matches Microsoft's patched versions; a partially updated farm remains exploitable.

2. Rotate ASP.NET machine keys and restart IIS

   Patching does not undo stolen secrets. Rotate SharePoint's machine keys after updating, and run a full iisreset, so that any keys an attacker exfiltrated before patching can no longer be used to forge trusted payloads. Treat this step as mandatory for any internet-facing farm, not optional cleanup.

3. Enable AMSI in Full mode

   Turn on SharePoint's Antimalware Scan Interface (AMSI) integration and set Request Body Scan mode to Full, so that malicious deserialization payloads are inspected before processing. This blocks a significant portion of the observed exploit traffic even where patching is delayed.

4. Remove SharePoint from the public internet

   Place on-premises SharePoint behind a VPN or identity-aware proxy, restrict access to trusted networks, and disable external access to SharePoint Central Administration. An internet-facing farm is the precondition for this entire attack; removing it eliminates the remote vector.

5. Hunt for compromise and validate your defences

   Assume any internet-facing, previously unpatched server may be compromised. Search for unfamiliar .aspx files in the SharePoint layouts directories, suspicious child processes of w3wp.exe, unexpected IIS modules, and scheduled-task persistence. Engage a penetration testing team to confirm that the patch, key rotation, and hardening actually closed the path, and a security code review of any custom SharePoint solutions or deserialization logic to find related weaknesses.

Pressing questions

• We use SharePoint Online in Microsoft 365. Are we affected?

  No. CVE-2026-56164 and the chained flaws affect only on-premises SharePoint Server (2016, 2019, and Subscription Edition). SharePoint Online in Microsoft 365 is not in scope. If you run any on-premises farm, however, including hybrid deployments, it must be patched.

• We patched on July 14. Are we safe?

  Not necessarily. If your server was internet-facing and exploited before you patched, attackers may have already stolen its machine keys, which the patch does not rotate. You must rotate the machine keys and hunt for persistence to be confident the intruder is gone. Patching alone stops new exploitation; it does not evict an attacker who already got in.

• Why is Microsoft's CVSS score only 5.3 if this is so serious?

  The base score reflects the flaw in isolation, an elevation of privilege, rather than its real-world use. Chained with the spoofing and deserialization bugs, it delivers unauthenticated remote code execution, which the NVD's 9.8 score captures. Treat the exploited-in-the-wild status, not the base score, as your priority signal.

• How is this related to the 2025 "ToolShell" attacks?

  The 2026 activity uses the same technique: reach a SharePoint server without authentication, steal its machine keys, forge a ViewState payload for code execution, and persist. In 2025 that chain compromised more than 400 organisations and ended in espionage and Warlock ransomware. The 2026 flaws are different CVEs but the same class of attack against the same product.

Key takeaways

CVE-2026-56164 is a textbook example of why "exploited in the wild" matters more than a base CVSS score. An unauthenticated, zero-click flaw in one of the most widely deployed enterprise platforms, chained with two companion bugs into reliable remote code execution and actively used by capable actors, it demands emergency handling regardless of the 5.3 Microsoft assigned it. The record-breaking 622-CVE Patch Tuesday it arrived in should not be allowed to bury it.

The defining lesson is that patching is necessary but not sufficient. Because attackers steal machine keys that survive the update, every internet-facing SharePoint farm exploited before patching needs key rotation and a hunt for persistence, not just the July fix. Remove SharePoint from the public internet, enable AMSI, rotate the keys, and validate through testing that the intruder's path is truly closed. The organisations breached by ToolShell in 2025 learned that lesson the hard way; the 2026 campaign is a chance to apply it before, not after.