When “Patched” Doesn’t Mean “Safe”: Inside the July 2026 SharePoint Server Exploitation Wave

Between April and mid-July 2026, four separate vulnerabilities in on-premises Microsoft SharePoint Server were confirmed under active exploitation and added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Attackers used them to bypass authentication, execute code remotely, and establish long-term persistence on compromised servers — including stealing IIS machine keys, a technique that lets an attacker maintain access even after a server is patched.

If your organization runs an on-premises SharePoint environment — or a managed service provider runs one on your behalf — this is not a "someday" patching item. It's an active, ongoing exposure.

What actually happened

CISA's alert names four vulnerabilities, all affecting every supported on-premises SharePoint Server edition (Subscription Edition, 2019, and 2016):

CVE-2026–32201 Added to KEV April 14, 2026

CVE-2026–45659 — Remote code execution via deserialization of untrusted data CVSS 8.8 · Patched May 2026 (out-of-band); added to KEV July 1, 2026

CVE-2026–56164 — Missing authentication (CWE-306), enabling privilege escalation Patched via July 2026 Patch Tuesday; added to KEV July 14, 2026

CVE-2026–58644 — Deserialization of untrusted data, remote code execution CVSS 9.8 · Patched July 14, 2026; added to KEV July 16, 2026

A few details are worth sitting with:

CVE-2026–56164 requires no valid credentials at all. It's a missing-authentication flaw — an attacker doesn't need to compromise a user account first. Successful exploitation hands them elevated privileges directly, which can mean access to internal documents, the ability to modify content, create new accounts, or move laterally into other connected systems.

CVE-2026–45659 only needs a low-privilege account. Microsoft confirmed that an attacker with nothing more than baseline Site Member permissions — no admin rights, no elevated access — can trigger remote code execution through it. Microsoft's own pre-release assessment rated exploitation as "less likely." That assessment turned out to be wrong; CISA's KEV listing exists specifically because real-world exploitation was confirmed.

CVE-2026–58644 has a CVSS score of 9.8 — about as severe as the scoring system goes. Microsoft has since clarified it was exploited as a zero-day before a fix was even available, meaning organizations had no patch to apply during the window it was actively being used.

The post-exploitation pattern is what makes this dangerous beyond the initial breach. According to CISA, attackers aren't just getting in — they're stealing IIS machine keys and using deserialization techniques to establish persistence and deploy malware. Stolen machine keys are particularly concerning because they can potentially be used to forge trusted requests even after the original vulnerability is patched, which is why CISA's hardening guidance goes beyond "install the update" to include rotating IIS machine keys and hunting for intrusion artifacts that may already be present.

Why "we patched it" isn't the end of the conversation

This case illustrates a pattern that shows up repeatedly in real-world incidents, and it's worth generalizing beyond SharePoint specifically:

1. Patch timing gaps get exploited. CVE-2026–45659 was patched in May, but Microsoft didn't publish the corresponding security bulletin until several weeks later. During that window, organizations had no reliable way to know the patch addressed an actively exploited flaw — they may have deprioritized it as routine maintenance rather than urgent remediation.
2. "Low privilege required" is not the same as "low risk." Two of these four vulnerabilities need either no authentication or only baseline user permissions. Internal threat modeling that assumes an attacker needs elevated access to do damage doesn't hold up against this class of flaw.
3. Persistence mechanisms outlive the patch. If an attacker stole IIS machine keys before you patched, applying the update alone does not remove their access. This is the step most organizations skip — and it's the step that turns "we're patched" into a false sense of security.
4. Internet-exposed on-premises services are a disproportionately attractive target. SharePoint servers typically sit at the center of internal workflows, document repositories, and identity integrations — which is exactly why they're worth the effort for attackers, and exactly why they warrant more scrutiny than a standard web-facing asset.

What this means for GCC organizations specifically

Kuwait and the wider GCC region have a significant base of on-premises Microsoft infrastructure, often managed by regional MSPs rather than in-house security teams. That combination — on-prem software, third-party management, and infrequent independent verification — is precisely the environment where a gap like the May-to-July SharePoint patch bulletin delay goes unnoticed the longest.

A few practical questions worth asking this week:

• Does anyone in your organization know with certainty whether your SharePoint Server (or your MSP's) is patched against all four of these CVEs?
• If it was vulnerable at any point before patching, has anyone checked for signs of prior compromise — not just confirmed the patch is now installed?
• Is your SharePoint instance internet-exposed, and if so, is that exposure necessary?
• When was the last time this environment was independently pentested, rather than just patched on a vendor's schedule?

How a VAPT engagement addresses this class of risk

This is the exact gap vulnerability assessment and penetration testing is designed to close. A proper VAPT engagement doesn't just check whether a patch is installed — it verifies whether the underlying exposure has actually been remediated, tests whether persistence mechanisms like stolen credentials or forged keys could still grant access, and identifies unnecessary internet exposure before an attacker finds it first.

Patching tells you a known issue was addressed. Testing tells you whether you're actually safe.

If you're unsure whether your on-premises SharePoint environment — or any internet-facing infrastructure — has been independently verified as secure, XDefense's VAPT team can help you find out before someone else does.

Sources: CISA Alert (July 14, 2026), BleepingComputer, SecurityWeek, The Hacker News, Cybersecurity News