Skip to content
HACKTECH
Exploited vulnerabilitiesReported Published 8 sources

Eight SharePoint flaws added to CISA's exploited list between March and September 2026

According to the catalogue's 6 November edition, CISA added eight Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities catalogue between 18 March and 25 September 2026. Microsoft's security update data marks CVE-2026-32201 (April) and CVE-2026-56164 (July) as exploited, and CISA added both on the day their fixes were released. Microsoft changed its record for CVE-2026-58644 to exploited one day after documenting it on 14 July, noting that the fix had shipped in June without the CVE being listed. CISA warned in July that the exploited flaws can be used for remote code execution and post-exploitation activity, including stealing IIS machine keys, to gain persistence and deploy malware.

  • Microsoft
  • SharePoint
  • collaboration platforms
  • zero-days
  • n-day exploits
  • machine keys
  • CISA KEV

What the sources report

  • CISA's 2026 KEV additions for SharePoint are CVE-2026-20963 (18 March), CVE-2026-32201 (14 April), CVE-2026-45659 (1 July), CVE-2026-56164 (14 July), CVE-2026-58644 (16 July), CVE-2026-50522 (22 July), CVE-2026-55040 (18 August) and CVE-2026-65660 (25 September). CISA lists CVE-2026-45659 as used in ransomware campaigns.
  • CVE-2026-32201, a CVSS 6.5 spoofing flaw, was exploited as a zero-day before its 14 April fix. A week later Shadowserver counted over 1,300 unpatched internet-exposed SharePoint servers, with fewer than 200 patched since the update (BleepingComputer).
  • CVE-2026-56164 (CVSS 5.3) is an elevation of privilege flaw that CISA describes as missing authentication for a critical function, exploitable over the network without credentials. Microsoft credited researchers from Google Cloud's FLARE team and Mandiant Incident Response, and Orca said it was discovered during real-world attacks.
  • Microsoft's FAQ says exploiting CVE-2026-58644 (CVSS 9.8) requires an attacker authenticated as at least a Site Owner, and its revision notes say the fix shipped in June but the CVE was inadvertently left out of that release. CVE-2026-45659 (CVSS 8.8) was likewise addressed by May updates but published only on 21 May after being inadvertently omitted.
  • Other flaws were exploited after fixes were out. CVE-2026-50522 (CVSS 9.8, deserialisation) and CVE-2026-55040 (CVSS 9.1, security feature bypass) were patched on 14 July and added to KEV on 22 July and 18 August. CVE-2026-65660 was patched on 11 August, and on 25 September Microsoft said it had reliable evidence of attacks against it.
  • SharePoint Server 2016 and 2019 reached end of extended support on 14 July 2026 (Orca). CISA's guidance includes verifying that AMSI integration is enabled, removing machine-key harvesting tools before rotating IIS machine keys, and blocking external access to Central Administration (The Hacker News).

What it means for your organisation

Two fixes reached customers before Microsoft documented their CVEs, CVE-2026-45659 with the May updates and CVE-2026-58644 in June, so teams that track exposure by CVE rather than by installed cumulative update could misjudge their status. CISA's warning that post-exploitation includes stealing IIS machine keys means patching without hunting for artefacts and rotating keys can leave an attacker's access in place.

What we check

  • Confirm every SharePoint farm has the August 2026 or later security updates by checking installed build numbers, and identify 2016 and 2019 farms that are now past end of extended support.
  • Check whether SharePoint sites and Central Administration can be reached from the internet, and whether AMSI integration is enabled for each web application.
  • Look for web shells and machine-key harvesting tools, and rotate ASP.NET machine keys only after cleanup.
  • Review Site Owner and farm administrator assignments, since Microsoft says CVE-2026-58644 and CVE-2026-50522 can be exploited by an attacker authenticated as at least a Site Owner.
  • Review IIS and ULS logs for unusual requests and new .aspx files in SharePoint directories around each patch date.

Sources

Services that cover these checks

  • Web application testing

    Authenticated, role-aware testing of your application and its API surface, with an account for every role. We chain small findings into the access they lead to, such as a sequential invoice ID and a missing tenant check that together let one customer read another's invoices.

    Duration: 5 to 10 working days

  • Application security audit

    A white-box review of your application: source code, architecture, dependencies and build pipeline. Automated analysis finds the candidates; reviewers confirm each one by reading the code path, and only confirmed defects reach the report, each with a file and line reference.

    Duration: 5 to 15 working days, depending on codebase size

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works