CISA Urges SharePoint Hardening After New Exploitations

Intro

With the addition of CVE-2026–58644 to the Known Exploited Vulnerabilities (KEV) catalog on July 16, CISA has issued an urgent warning: your internal servers are now the primary theater for sophisticated Remote Code Execution (RCE) and persistence-building operations. For the modern security strategist, this isn't just another patch cycle — it's a fundamental shift in defensive priority.

On-Premises Server

The perception of on-premises security as a "safe harbor" is being dismantled by active exploitation. CISA has confirmed that threat actors are successfully targeting all supported versions, including SharePoint Server 2016, 2019, and the Subscription Edition.

The goal is no longer a simple "smash and grab" of data. Instead, attackers are performing advanced deserialization techniques to gain long-term persistence. By establishing RCE, they can move laterally and deploy malware directly into your infrastructure's core.

"CISA is aware of active exploitation of vulnerabilities… enabling cyber threat actors to gain unauthorized access to on-premises SharePoint Server instances. These vulnerabilities… involve establishing remote code execution (RCE) and post-exploitation activities, such as stealing Internet Information Services (IIS) machine keys and performing deserialization techniques, to gain persistence and deploy malware."

Zero Credentials, Maximum Risk

While the KEV updates focus on active exploits, CISA is pointing a flashing red light at CVE-2026–55040. This vulnerability is a "Security Feature Bypass" born from "Weak Authentication," and its CVSS score of 9.1 is a nightmare for administrators.

The most terrifying metric here is PR:N (Privileges Required: None). An attacker requires zero credentials and no user interaction to exploit this over the network. It is the ultimate "easy win" for a threat actor.

• Score: 9.1 (CRITICAL)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
• The Bottom Line: Low attack complexity and no login requirements mean this bypass can be automated at scale.

AMSI

The Antimalware Scan Interface (AMSI) has officially graduated from a "best practice" to a non-negotiable requirement. As of the September 2025 Public Update, AMSI integration is a mandatory component for SharePoint Server that can no longer be deactivated.

This enforcement is strategic. AMSI's role is to intercept and inspect requests before they are processed by SharePoint. This provides a critical proactive layer that can stop a zero-day exploit even if the official security patch hasn't been installed yet.

"The AMSI integration functionality is designed to prevent malicious web requests from reaching SharePoint endpoints. For example, to exploit a security vulnerability in a SharePoint endpoint before the official fix for the security vulnerability has been installed."

IIS and Machine Key Rotation

In the wake of a compromise, the first instinct is often to rotate IIS machine keys. However, without proper remediation, this is merely security theater. Attackers are now deploying "machine-key harvesters" — malicious scripts that sit dormant in the environment, waiting for new keys to be generated so they can steal them instantly.

Furthermore, stolen machine keys are the "skeleton keys" for deserialization attacks, allowing attackers to forge tokens and maintain persistence. CISA's guidance is firm: you must hunt for and remediate all intrusion artifacts before rotating keys. Rotating keys on an infected system is simply giving the attacker a fresh set of credentials.

Deep Inspection: Scanning the Payload "Body"

Historically, security tools focused on request headers, but modern threats are increasingly buried within the payload body. To address this, SharePoint Server Subscription Edition (SPSE) Version 25H1 introduced the Request Body Scan feature.

While users of SharePoint 2016 and 2019 are limited to header scanning, SPSE administrators must now decide which scanning mode fits their risk profile. "Full Mode" is the new gold standard for high-security environments.

• Off: Disables body scanning (headers only).
• Balanced Mode: Scans request bodies sent to system-predefined sensitive endpoints.
• Full Mode: Scans request bodies sent to all endpoints (except explicit exclusions), providing the most comprehensive defense against embedded payloads.

Internet-Facing SharePoint Servers

Directly exposing a SharePoint Server to the internet is now considered a high-risk legacy configuration. The days of "direct access" are over. CISA now recommends that SharePoint only be accessible via a Layer 7 reverse proxy or an equivalent application-layer control.

Crucially, this proxy cannot be a simple pass-through. It must be an identity-aware gatekeeper capable of requiring authentication and performing deep packet inspection. By forcing authentication at the proxy level, you strip away the "No Privileges" advantage that attackers rely on for vulnerabilities like CVE-2026–55040.