CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities
2026-07-16T20:52:47Z•f624043f0caf737f0f1c2ca622efea33a3c8f7a2b6bdfb2c24a0a39c612304a1
CISA alertIIS machine key theftMicrosoft Defender detectionsMicrosoft SharePointactive exploitationhardeningincident responseon-premisespatch availableremote code execution
What happened
CISA confirmed active exploitation of multiple on-premises Microsoft SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) that have been used to gain unauthorized access, achieve remote code execution, exfiltrate IIS machine keys, and deploy persistent malware. Microsoft released patches for these and two additional SharePoint flaws (CVE-2026-55040, CVE-2026-58644); Microsoft Defender detection signatures are available for several of the exploited issues and Microsoft later flagged CVE-2026-58644 as being exploited. Organizations running on-prem SharePoint should,
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- tenable_blog
- Record identifier
- f624043f0caf737f0f1c2ca622efea33a3c8f7a2b6bdfb2c24a0a39c612304a1
- Enrichment time
- 2026-07-16T20:52:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.