# CISA warns of actively exploited SharePoint vulnerabilities Three critical flaws being used in attacks, agency confirms - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-07-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/c422e787-66f0-44d8-a282-103e9a0e0e10 ## Critical Alert The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about three actively exploited vulnerabilities in SharePoint servers. Organizations must update all supported SharePoint versions immediately. ## Vulnerability Details CVE-2026-32201 (6.5) spoofing, CVE-2026-45659 (8.8) remote code execution, and CVE-2026-56164 (5.3) privilege escalation flaws are being used to steal IIS machine keys and deploy malware in post-exploitation activities. ## Additional Threats CISA highlighted two more critical vulnerabilities (CVE-2026-55040 and CVE-2026-58644) from the latest Patch Tuesday. While Microsoft labeled them as 'more likely to be exploited,' no active attacks have been reported yet. ## Attack Patterns The agency noted similarities with 2025 'ToolShell' attacks. Chinese state-sponsored groups were previously reported chaining these vulnerabilities to distribute Warlock ransomware. ## Mitigation Steps Immediate recommendations include applying Microsoft's latest security patches, verifying AMSI integration, rotating IIS keys, and blocking external access to SharePoint Central Administration. ## Proactive Defense CISA advises organizations to hunt for intrusion signs and implement robust logging systems. SharePoint's prevalence in critical infrastructure makes these warnings particularly significant for enterprise security. ## Sources covering this story - https://www.theregister.com/security/2026/07/15/cisa-sounds-alarm-over-trio-of-exploited-sharepoint-flaws/5271814 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._