on-prem sharepoint server: six exploited flaws in one cisa alert
Attackers used on-premises SharePoint Server bugs to run code, steal IIS machine keys and plant malware, and CISA's alert grew to cover six exploited CVEs.
- cve
- CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522, CVE-2026-55040
- cvss
- 9.8 (v3.1, Microsoft) for CVE-2026-58644
- affected
- SharePoint Server Subscription Edition, 2019 and 2016 (on-premises)
- exploited
- yes — six CVEs in CISA KEV; CVE-2026-58644 added 2026-07-16
- platforms
- on-premises Microsoft SharePoint Server
what happened
- On July 14, 2026, CISA published an alert on active exploitation of on-premises SharePoint Server. With updates through August 2026 it covers six CVEs (CVE-2026-32201, -45659, -56164, -58644, -50522 and -55040) affecting Subscription Edition, 2019 and 2016.[1,4]
- CISA says attackers gain remote code execution, steal IIS machine keys and use deserialization techniques to stay in and deploy malware.[1]
- Microsoft published CVE-2026-58644, a critical deserialization flaw scored 9.8 (CVSS v3.1), on July 14, 2026, noting that its security update had already shipped but the CVE was inadvertently left out of the June 2026 release. A July 15 revision corrected its Exploited flag, which now reads Yes.[2]
- CISA added CVE-2026-45659 to KEV on 2026-07-01 and marks it as known to be used in ransomware. CVE-2026-56164 followed on 2026-07-14, CVE-2026-58644 on 2026-07-16, CVE-2026-50522 on 2026-07-22 and CVE-2026-55040 on 2026-08-18.[1,3]
- Tenable lists the CVE-2026-58644 fixed builds as 16.0.5556.1005 (2016), 16.0.10417.20153 (2019) and 16.0.19725.20384 (Subscription Edition).[4]
- CISA warns that IIS machine keys should be rotated only after hunting for and removing intrusion artifacts such as machine-key harvesters, or the new keys can be stolen too.[1]
- Microsoft's lifecycle page lists the end of extended support for SharePoint Server 2019 as July 15, 2026.[5]
where sources differMicrosoft's CVSS vector for CVE-2026-58644 says no privileges are needed (PR:N), but its FAQ says the attacker must be authenticated as at least a Site Owner. For CVE-2026-56164, Tenable reports 9.8 from NVD against 5.3 from Microsoft. Tenable says CISA's original July 14 alert covered three exploited CVEs and listed CVE-2026-58644 and CVE-2026-55040 as not yet exploited; both were added to KEV later.
sources5
- 01CISA Urges SharePoint Hardening After New Exploitations ↗ primaryCISAaccessed 2026-10-21
- 02Microsoft SharePoint Remote Code Execution Vulnerability (CVE-2026-58644, Security Update Guide) ↗ primaryMicrosoft Security Response Centeraccessed 2026-10-21
- 03CISA Known Exploited Vulnerabilities Catalog (JSON feed, catalogVersion 2026.10.21) ↗ primaryCISAaccessed 2026-10-21
- 04
- 05SharePoint Server 2019 - Microsoft Lifecycle ↗ primaryMicrosoft Learnaccessed 2026-10-21