# CISA Warns About Exploited SharePoint Vulnerabilities Three critical security flaws threaten SharePoint users. - **Source:** [www.theregister.com - Articles](https://brifing.si/source/2c34ea50-d341-4a10-925d-12c012a9ad10) - **Published:** 2026-07-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/ba84c5a4-ff0f-4854-b5f4-65960585c95c ## Critical Vulnerabilities in SharePoint CISA has disclosed three actively exploited vulnerabilities in SharePoint Server, including a spoofing flaw (CVE-2026-32201), a remote code execution (RCE) vulnerability (CVE-2026-45659), and a privilege escalation flaw (CVE-2026-56164). These vulnerabilities can lead to system compromise and malware deployment. ## Impact of the Vulnerabilities These security flaws allow attackers to steal Internet Information Services (IIS) machine keys and use deserialization techniques to gain persistence. Microsoft previously reported that these flaws were exploited by Chinese state-sponsored groups. CISA specifically warned against 'ToolShell' attacks. ## Additional Threats CISA also highlighted two critical vulnerabilities (CVE-2026-55040 and CVE-2026-58644) from the latest Patch Tuesday. These flaws are not yet actively exploited but were labeled 'Exploitation More Likely' by Microsoft. They could further complicate SharePoint security. ## Recommended Measures CISA advises organizations to apply Microsoft's latest security patches and verify Antimalware Scan Interface (AMSI) integration is enabled. Additionally, threat hunting for signs of intrusion before rotating IIS keys is recommended. ## Additional Security Steps Organizations should block external access to SharePoint Central Administration and only expose SharePoint to the web when necessary. CISA also recommends implementing robust, tailored logging to detect potential exploits. ## Conclusion and Importance This warning underscores the urgent need for SharePoint users to update their security measures. The active exploitation of these flaws poses a serious threat. Following CISA's recommendations can significantly reduce the risk of cyberattacks. ## Sources covering this story - https://www.theregister.com/security/2026/07/15/cisa-sounds-alarm-over-trio-of-exploited-sharepoint-flaws/5271814 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._