CISA Warns About Exploited SharePoint Vulnerabilities
Three critical security flaws threaten SharePoint users.
1Critical Vulnerabilities in SharePoint
CISA has disclosed three actively exploited vulnerabilities in SharePoint Server, including a spoofing flaw (CVE-2026-32201), a remote code execution (RCE) vulnerability (CVE-2026-45659), and a privilege escalation flaw (CVE-2026-56164). These vulnerabilities can lead to system compromise and malware deployment.
2Impact of the Vulnerabilities
These security flaws allow attackers to steal Internet Information Services (IIS) machine keys and use deserialization techniques to gain persistence. Microsoft previously reported that these flaws were exploited by Chinese state-sponsored groups. CISA specifically warned against 'ToolShell' attacks.
3Additional Threats
CISA also highlighted two critical vulnerabilities (CVE-2026-55040 and CVE-2026-58644) from the latest Patch Tuesday. These flaws are not yet actively exploited but were labeled 'Exploitation More Likely' by Microsoft. They could further complicate SharePoint security.
4Recommended Measures
CISA advises organizations to apply Microsoft's latest security patches and verify Antimalware Scan Interface (AMSI) integration is enabled. Additionally, threat hunting for signs of intrusion before rotating IIS keys is recommended.
5Additional Security Steps
Organizations should block external access to SharePoint Central Administration and only expose SharePoint to the web when necessary. CISA also recommends implementing robust, tailored logging to detect potential exploits.
6Conclusion and Importance
This warning underscores the urgent need for SharePoint users to update their security measures. The active exploitation of these flaws poses a serious threat. Following CISA's recommendations can significantly reduce the risk of cyberattacks.