# CISA Flags Active Exploitation of SharePoint Flaws

Published: 2026-07-14 · Severity: high · Sectors: technology, government-national
Canonical: https://vorant.io/reports/6d6549c3-3b4a-5f61-8c67-385a0d4db29d/cisa-flags-active-exploitation-of-sharepoint-flaws

> CISA warns three on-prem SharePoint Server vulnerabilities are under active exploitation for RCE, IIS machine-key theft, and persistence.

CISA has issued an alert confirming active exploitation of three vulnerabilities—CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164—affecting all supported on-premises Microsoft SharePoint Server editions (Subscription Edition, 2019, and 2016). All three have been added to CISA's Known Exploited Vulnerabilities catalog. Threat actors are chaining these flaws to achieve remote code execution, then conducting post-exploitation activity including theft of IIS machine keys and deserialization abuse to establish persistence and deploy malware, including a Microsoft-tracked backdoor identified as Backdoor:MSIL/LeakFang.A!dha.

Microsoft has released detection signatures for AMSI and Microsoft Defender Antivirus tied to specific exploitation stages, including request-body and header scanning detections for ToolPane authentication bypass and RCE attempts. CISA recommends organizations patch immediately, enable full AMSI request-body scanning, hunt for machine-key harvesters before rotating IIS keys, restrict internet exposure of SharePoint servers behind authenticated Layer 7 proxies, and tighten logging and network segmentation around SharePoint farms. Additional vulnerabilities disclosed by Microsoft are not yet observed as exploited but pose risk if left unpatched.

This activity represents an active, ongoing exploitation campaign against a widely deployed on-premises enterprise platform, with confirmed real-world targeting and KEV inclusion driving urgency for immediate remediation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-32201 (KEV), CVE-2026-45659 (KEV), CVE-2026-56164 (KEV)
- Malware: LeakFang

## Detection guidance (public sample)

### SharePoint IIS Worker Process Spawning Command Interpreter (Possible Web Shell/RCE)

ATT&CK: T1505.003

Detects w3wp.exe (IIS worker process, e.g. SharePoint app pool) spawning cmd.exe, powershell.exe, or scripting engines - a strong indicator of a web shell or RCE exploit chain landing code execution through the SharePoint web application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SharePoint IIS Worker Process Spawning Command Interpreter (Possible Web Shell/RCE)
description: Detects the IIS worker process (w3wp.exe) spawning command interpreters
  or scripting engines. On SharePoint servers this is a strong indicator of successful
  exploitation of RCE/deserialization vulnerabilities (e.g. ToolPane, deserialization
  chains) resulting in web shell or in-memory command execution rather than normal
  SharePoint operation.
tags:
- attack.persistence
- attack.t1505.003
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \cscript.exe
    - \wscript.exe
    - \mshta.exe
  filter_known_admin:
    CommandLine|contains:
    - Get-SPFarm
    - Get-SPServiceInstance
  condition: selection and not filter_known_admin
falsepositives:
- Legitimate SharePoint administration scripts invoked through custom timer jobs or
  workflows
- Third-party SharePoint add-ins that shell out for automation (rare, should be allowlisted
  by path/hash)
level: high
id: 7768fe8a-c2af-534c-bdc4-87a256feecc2
status: experimental
author: Vorant
```

### Potential IIS/ASP.NET Machine Key Export or Enumeration

ATT&CK: T1552.004

Detects commands and process activity consistent with harvesting IIS/ASP.NET machine keys (validationKey/decryptionKey) or exporting certificates/private keys, matching the post-exploitation credential-theft stage described for SharePoint RCE chains prior to persistence via deserialization. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Potential IIS/ASP.NET Machine Key Export or Enumeration
description: Detects process command lines referencing ASP.NET machine key material
  (validationKey, decryptionKey, machineKey) or use of certutil/PowerShell to export
  keys/certificates from an IIS/SharePoint host. This matches reported post-exploitation
  activity where attackers harvest IIS machine keys to forge tokens or enable deserialization-based
  persistence.
tags:
- attack.credential-access
- attack.t1552.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_keywords:
    CommandLine|contains:
    - machineKey
    - validationKey
    - decryptionKey
    - Get-SPSecurityTokenServiceConfig
  selection_export_tools:
    Image|endswith:
    - \certutil.exe
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains:
    - -exportpfx
    - -exportcert
    - ConvertTo-SecureString
  condition: selection_keywords or selection_export_tools
falsepositives:
- Legitimate SharePoint farm administrators rotating machine keys as part of scheduled
  maintenance
- Certificate management scripts run by PKI/IIS administrators unrelated to SharePoint
  compromise
level: medium
id: d9dff00b-c0f6-58ed-865e-e734efc2e4cd
status: experimental
author: Vorant
```

### ASPX Web Shell Dropped in SharePoint LAYOUTS/TEMPLATE Directory

ATT&CK: T1505.003

Detects creation of .aspx files within SharePoint's LAYOUTS or TEMPLATE directories by the IIS worker process, consistent with web shell deployment following exploitation of SharePoint RCE/deserialization vulnerabilities such as those chained via ToolPane. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ASPX Web Shell Dropped in SharePoint LAYOUTS/TEMPLATE Directory
description: Detects the creation of new .aspx files inside SharePoint's 15/16 hive
  LAYOUTS or TEMPLATE folders by the w3wp.exe worker process. Attackers exploiting
  SharePoint RCE chains commonly drop web shells into these web-accessible directories
  to gain durable command execution.
tags:
- attack.persistence
- attack.t1505.003
- attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \w3wp.exe
    TargetFilename|contains:
    - \TEMPLATE\LAYOUTS\
    - \TEMPLATE\\1033\
    TargetFilename|endswith: .aspx
  filter_deployment:
    TargetFilename|contains: \_catalogs\
  condition: selection and not filter_deployment
falsepositives:
- SharePoint solution/feature deployment (WSP) that legitimately writes new .aspx
  pages during patch or farm updates
- Custom branding or page-layout deployments performed by SharePoint administrators
level: high
id: 66a7d591-9342-5f40-8a38-f2fb32768aec
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6d6549c3-3b4a-5f61-8c67-385a0d4db29d/cisa-flags-active-exploitation-of-sharepoint-flaws.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup