Loading story…
CISA added a Microsoft SharePoint compromise template to its free Eviction Strategies Tool to help incident-response teams contain and remove attackers from compromised on-premises SharePoint servers. Built on Playbook-NG and the COUN7ER countermeasure database, the template maps relevant MITRE ATT&CK techniques to ten post-compromise actions that organizations can tailor for response playbooks, including critical-infrastructure operators such as water and wastewater utilities.
The guidance follows severe on-premises SharePoint Server flaws, including CVE-2025-53770 and CVE-2025-53771, which can enable unauthorized access to SharePoint, theft of sensitive information, and lateral movement into broader IT environments. Microsoft issued security updates, while the Dutch NCSC reported monitoring exploitation and notifying affected Dutch organizations; SharePoint Online in Microsoft 365 is not affected.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
CISA added an on-premises Microsoft SharePoint compromise template that maps relevant MITRE ATT&CK techniques to ten post-compromise countermeasures. The template can be customized and exported as part of an incident-response playbook.
CISA initially released its no-cost Eviction Strategies Tool, including Playbook-NG and the COUN7ER countermeasure database, to help organizations build customized adversary-eviction playbooks.
The Dutch NCSC found vulnerable SharePoint systems at multiple Dutch and foreign organizations and notified several Dutch organizations whose vulnerability had been exploited. It began monitoring possible exploitation and urged organizations to apply mitigations and inspect for compromise.
Microsoft released security updates for CVE-2025-53770 and CVE-2025-53771, severe flaws affecting on-premises SharePoint Server 2016, 2019, and Subscription Edition. SharePoint Online in Microsoft 365 was not affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA and Microsoft warned that multiple **on-premises SharePoint Server** vulnerabilities are being actively exploited against internet-facing systems, with attackers using a chain involving `CVE-2026-32201`, `CVE-2026-45659`, and `CVE-2026-56164` to gain unauthorized access, execute code, steal IIS and ASP.NET machine keys, maintain persistence, and deploy malware. The agencies said the activity affects supported on-premises SharePoint deployments rather than SharePoint Online, and follows earlier Microsoft reporting that Chinese threat actors including **Linen Typhoon**, **Violet Typhoon**, and **Storm-2603** had abused similar SharePoint flaws to install web shells, dump credentials, move laterally, and in some cases deploy **Warlock ransomware**. Microsoft’s July 2026 updates also fixed two additional critical SharePoint bugs, `CVE-2026-55040` and `CVE-2026-58644`, which were not yet confirmed as exploited but were assessed as likely targets for rapid weaponization, while separate reporting said another SharePoint exploit chain may remain unpatched pending a later release. Defenders were urged to immediately apply available patches, enable **AMSI** in Full Mode, reduce or remove internet exposure, restrict access to SharePoint Central Administration, review logs and endpoint telemetry for compromise, and only rotate IIS or ASP.NET machine keys after confirming whether intrusion activity is already present.
Aug 27, 2026
**CISA** added **CVE-2026-20963**, a **Microsoft SharePoint** deserialization flaw, to its **Known Exploited Vulnerabilities (KEV)** catalog after confirming active exploitation in the wild. The vulnerability allows an **unauthorized remote attacker** to execute arbitrary code over the network by sending crafted serialized data that SharePoint improperly deserializes, creating a **pre-authentication remote code execution** path. Reporting indicates the specific threat actors behind the attacks have not been publicly identified, but the flaw affects a widely deployed enterprise collaboration platform that often stores sensitive internal documents and communications. The KEV entry triggered urgent remediation requirements, including a **March 21, 2026** deadline for **FCEB agencies** under **Binding Operational Directive 22-01**. Additional reporting notes that the same KEV update also included vulnerabilities in **Wing FTP Server** and **Synacor Zimbra Collaboration Suite**, but the SharePoint issue stands out because of its likely value for **initial access brokers** and **ransomware affiliates** seeking enterprise footholds. Organizations using SharePoint should treat internet-exposed systems as high priority for patching and review for signs of compromise given confirmed in-the-wild exploitation.
Jun 29, 2026
CISA added **`CVE-2026-45659`** to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a high-severity remote code execution flaw in on-premises **Microsoft SharePoint Server**. The vulnerability stems from **deserialization of untrusted data** (`CWE-502`) and carries a **CVSS 8.8** score. It affects **SharePoint Enterprise Server 2016**, **SharePoint Server 2019**, and **SharePoint Server Subscription Edition** below patched versions, and can be exploited over the network by an authenticated attacker with low privileges such as **Site Member**, without user interaction. Microsoft issued fixes in its **May 2026** security updates, later clarifying that the CVE had been inadvertently omitted from the initial update list. CISA set a **July 4, 2026** remediation deadline for federal civilian agencies under Binding Operational Directive 22-01, while public reporting said the exact vulnerable SharePoint component, gadget chain, payload delivery method, and any connection to ransomware activity had not yet been disclosed. Security guidance accompanying the KEV listing urged organizations to patch immediately and review exposed SharePoint environments for signs of compromise.
Jul 10, 2026