The U.S. cybersecurity agency CISA reports active exploitation of multiple vulnerabilities in on-premises SharePoint Server.
According to CISA, cyber threat actors are exploiting vulnerabilities in all supported versions of SharePoint Server, including Subscription Edition, 2019, and 2016. The security flaws are identified as CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164. Attackers use these vulnerabilities to bypass authentication, perform remote code execution, steal IIS machine keys, and establish persistent access by installing malware. Organizations are advised to patch their systems immediately and take additional security measures to prevent unauthorized access and malware.
Two new CVEs
In addition to the vulnerabilities already being exploited, two new CVEs (CVE-2026-55040 and CVE-2026-58644) were recently disclosed. While not yet actively exploited, Microsoft warns they pose a significant risk if not patched in time. The recommendation is to install all security updates as soon as possible and shorten the patch cycle where possible.
Security measures
CISA advises enabling Antimalware Scan Interface (AMSI) integration for every SharePoint web application. Organizations should verify that this integration is correctly configured, preferably using ‘Full Mode’ for body scanning. If there are signs of compromise, CISA recommends using specific AMSI and Microsoft Defender Antivirus detections and activating the incident response plan upon positive detections.
Examples of detections include remote code execution attempts and signs of post-exploitation activities where sensitive IIS information is exfiltrated. It is important to actively monitor for suspicious webshells and anomalous SharePoint behavior using customized logging mechanisms.