Loading story…
Microsoft issued emergency guidance after attackers exploited zero-day flaws in on-premises Microsoft SharePoint Server in campaigns that hit businesses and at least some U.S. government agencies. In one wave, researchers tracked a variant of CVE-2025-49706 dubbed "ToolShell," warning it could grant full access to SharePoint file systems and connected Microsoft services such as Teams and OneDrive. Microsoft said SharePoint Online was not affected, while fixes were released for SharePoint Server 2019 and Subscription Edition and a SharePoint Server 2016 patch was still pending at the time of reporting.
U.S. CISA later added another actively exploited SharePoint zero-day, CVE-2026-32201, to its Known Exploited Vulnerabilities catalog and ordered Federal Civilian Executive Branch agencies to remediate it under BOD 22-01. Security firms including Eye Security, CrowdStrike, Google Threat Intelligence Group, and Palo Alto Networks warned that internet-facing SharePoint deployments in government, education, healthcare, and large enterprises face elevated risk, with defenders urged to patch quickly, isolate exposed servers if needed, rotate cryptographic material, and engage incident response support where compromise is suspected.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-32201 affecting Microsoft SharePoint Server to its Known Exploited Vulnerabilities catalog and ordered Federal Civilian Executive Branch agencies to remediate it under Binding Operational Directive 22-01. The deadline for most required fixes was set for 2026-04-28.
Microsoft disclosed that CVE-2026-32201, an improper input validation spoofing vulnerability in Microsoft SharePoint Server, was being actively exploited in the wild as a zero-day. The flaw raised concern for organizations running internet-facing SharePoint servers because of risks including information disclosure and unauthorized modification.
Microsoft released emergency fixes and patch guidance for SharePoint Server 2019 and SharePoint Server Subscription Edition after the active exploitation was identified, while a fix for SharePoint Server 2016 was still in development. CISA and multiple security firms urged organizations to patch immediately, disconnect exposed servers if needed, rotate cryptographic material, and seek incident response support.
Attackers began exploiting a recently discovered zero-day affecting on-premises Microsoft SharePoint servers in widespread attacks against businesses and at least some U.S. government agencies. Researchers said the flaw, referred to as "ToolShell" and described as a variant of CVE-2025-49706, could enable full access to SharePoint file systems and connected services such as Teams and OneDrive.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourceapnews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
More than **1,370 internet-facing Microsoft SharePoint servers** were reported exposed to active exploitation of **`CVE-2026-32201`**, a spoofing vulnerability affecting SharePoint Server 2016, 2019, and Subscription Edition. Microsoft disclosed the flaw in April and CISA added it to the **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders. Although Microsoft scored the bug at **CVSS 6.5**, the risk is elevated because it can be exploited **remotely without authentication** against exposed on-premises deployments, potentially allowing attackers to impersonate users, access or alter sensitive content, steal credentials, and move laterally inside victim environments. The exposure comes amid broader concern over SharePoint security, including Microsoft's disclosure of **`CVE-2026-26106`**, a **remote code execution** vulnerability in SharePoint Server, and earlier reporting that a **China-linked threat actor** was involved in SharePoint attacks, according to Mandiant. The concentration of exposed systems was highest in the **United States**, and the combined reporting points to sustained attacker interest in SharePoint as a route into enterprise networks. Organizations were urged to apply Microsoft's available updates, reduce direct internet exposure of SharePoint servers, and closely monitor authentication and document-access activity for signs of compromise.
Jun 29, 2026
Microsoft released its largest Patch Tuesday update on record, fixing roughly **570 to 622 Microsoft CVEs** across Windows, Office, SharePoint Server, Exchange Server, SQL Server, Edge, Azure, Defender, and developer tools. The release included **three zero-days**, with **CVE-2026-56155** in **Active Directory Federation Services (AD FS)** and **CVE-2026-56164** in **on-premises Microsoft SharePoint Server** confirmed as exploited in the wild, while **CVE-2026-50661** patched a publicly disclosed **BitLocker** security feature bypass requiring physical access. Microsoft and multiple security outlets said the surge in findings was partly driven by AI-assisted vulnerability discovery, while the broader update also addressed dozens of critical remote code execution flaws in services such as DHCP, Hyper-V, Office, Exchange, SQL Server, Copilot, and SharePoint. U.S. agencies and industry groups elevated the urgency around SharePoint after CISA warned that attackers were actively exploiting **CVE-2026-56164** alongside **CVE-2026-32201** and **CVE-2026-45659** against internet-exposed on-premises servers, enabling unauthorized access, remote code execution, theft of IIS machine keys, persistence, and malware deployment. CISA added the exploited AD FS and SharePoint flaws to its **Known Exploited Vulnerabilities** catalog and urged immediate remediation, while Microsoft recommended SharePoint hardening measures including **AMSI integration with full request body scanning** and stronger Defender protections; exposed identity systems, SharePoint farms, and other internet-facing Microsoft services were identified as the highest-priority patch targets.
Jul 20, 2026
CISA and Microsoft warned that multiple **on-premises SharePoint Server** vulnerabilities are being actively exploited against internet-facing systems, with attackers using a chain involving `CVE-2026-32201`, `CVE-2026-45659`, and `CVE-2026-56164` to gain unauthorized access, execute code, steal IIS and ASP.NET machine keys, maintain persistence, and deploy malware. The agencies said the activity affects supported on-premises SharePoint deployments rather than SharePoint Online, and follows earlier Microsoft reporting that Chinese threat actors including **Linen Typhoon**, **Violet Typhoon**, and **Storm-2603** had abused similar SharePoint flaws to install web shells, dump credentials, move laterally, and in some cases deploy **Warlock ransomware**. Microsoft’s July 2026 updates also fixed two additional critical SharePoint bugs, `CVE-2026-55040` and `CVE-2026-58644`, which were not yet confirmed as exploited but were assessed as likely targets for rapid weaponization, while separate reporting said another SharePoint exploit chain may remain unpatched pending a later release. Defenders were urged to immediately apply available patches, enable **AMSI** in Full Mode, reduce or remove internet exposure, restrict access to SharePoint Central Administration, review logs and endpoint telemetry for compromise, and only rotate IIS or ASP.NET machine keys after confirming whether intrusion activity is already present.
Jul 20, 2026