CISA Flags Active Exploitation of SharePoint Flaws

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

CISA warns three on-prem SharePoint Server vulnerabilities are under active exploitation for RCE, IIS machine-key theft, and persistence.

Sourcecisa.gov — open the original

CISA has issued an alert confirming active exploitation of three vulnerabilities—CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164—affecting all supported on-premises Microsoft SharePoint Server editions (Subscription Edition, 2019, and 2016). All three have been added to CISA's Known Exploited Vulnerabilities catalog. Threat actors are chaining these flaws to achieve remote code execution, then conducting post-exploitation activity including theft of IIS machine keys and deserialization abuse to establish persistence and deploy malware, including a Microsoft-tracked backdoor identified as Backdoor:MSIL/LeakFang.A!dha.

Microsoft has released detection signatures for AMSI and Microsoft Defender Antivirus tied to specific exploitation stages, including request-body and header scanning detections for ToolPane authentication bypass and RCE attempts. CISA recommends organizations patch immediately, enable full AMSI request-body scanning, hunt for machine-key harvesters before rotating IIS keys, restrict internet exposure of SharePoint servers behind authenticated Layer 7 proxies, and tighten logging and network segmentation around SharePoint farms. Additional vulnerabilities disclosed by Microsoft are not yet observed as exploited but pose risk if left unpatched.

This activity represents an active, ongoing exploitation campaign against a widely deployed on-premises enterprise platform, with confirmed real-world targeting and KEV inclusion driving urgency for immediate remediation.

title: SharePoint IIS Worker Process Spawning Command Interpreter (Possible Web Shell/RCE)
description: Detects the IIS worker process (w3wp.exe) spawning command interpreters
  or scripting engines. On SharePoint servers this is a strong indicator of successful
  exploitation of RCE/deserialization vulnerabilities (e.g. ToolPane, deserialization
  chains) resulting in web shell or in-memory command execution rather than normal
  SharePoint operation.
tags:
- attack.persistence
- attack.t1505.003
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \cscript.exe
    - \wscript.exe
    - \mshta.exe
  filter_known_admin:
    CommandLine|contains:
    - Get-SPFarm
    - Get-SPServiceInstance
  condition: selection and not filter_known_admin
falsepositives:
- Legitimate SharePoint administration scripts invoked through custom timer jobs or
  workflows
- Third-party SharePoint add-ins that shell out for automation (rare, should be allowlisted
  by path/hash)
level: high
id: 7768fe8a-c2af-534c-bdc4-87a256feecc2
status: experimental
author: Vorant

title: Potential IIS/ASP.NET Machine Key Export or Enumeration
description: Detects process command lines referencing ASP.NET machine key material
  (validationKey, decryptionKey, machineKey) or use of certutil/PowerShell to export
  keys/certificates from an IIS/SharePoint host. This matches reported post-exploitation
  activity where attackers harvest IIS machine keys to forge tokens or enable deserialization-based
  persistence.
tags:
- attack.credential-access
- attack.t1552.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_keywords:
    CommandLine|contains:
    - machineKey
    - validationKey
    - decryptionKey
    - Get-SPSecurityTokenServiceConfig
  selection_export_tools:
    Image|endswith:
    - \certutil.exe
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains:
    - -exportpfx
    - -exportcert
    - ConvertTo-SecureString
  condition: selection_keywords or selection_export_tools
falsepositives:
- Legitimate SharePoint farm administrators rotating machine keys as part of scheduled
  maintenance
- Certificate management scripts run by PKI/IIS administrators unrelated to SharePoint
  compromise
level: medium
id: d9dff00b-c0f6-58ed-865e-e734efc2e4cd
status: experimental
author: Vorant

title: ASPX Web Shell Dropped in SharePoint LAYOUTS/TEMPLATE Directory
description: Detects the creation of new .aspx files inside SharePoint's 15/16 hive
  LAYOUTS or TEMPLATE folders by the w3wp.exe worker process. Attackers exploiting
  SharePoint RCE chains commonly drop web shells into these web-accessible directories
  to gain durable command execution.
tags:
- attack.persistence
- attack.t1505.003
- attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \w3wp.exe
    TargetFilename|contains:
    - \TEMPLATE\LAYOUTS\
    - \TEMPLATE\\1033\
    TargetFilename|endswith: .aspx
  filter_deployment:
    TargetFilename|contains: \_catalogs\
  condition: selection and not filter_deployment
falsepositives:
- SharePoint solution/feature deployment (WSP) that legitimately writes new .aspx
  pages during patch or farm updates
- Custom branding or page-layout deployments performed by SharePoint administrators
level: high
id: 66a7d591-9342-5f40-8a38-f2fb32768aec
status: experimental
author: Vorant

Source reporting: https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations

Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.