Reported by 1 outlet
Microsoft SharePoint Exploitation — Fourth KEV Entry, Tenable Confirms Five-CVE Active Exploitation Cluster
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
The cluster centers on five CVEs chained across on-premises SharePoint: CVE-2026-32201 (spoofing, CVSS 6.5) for initial access, CVE-2026-45659 (RCE, CVSS 8.8), CVE-2026-56164 (EoP, CVSS 9.8), CVE-2026-55040 (auth bypass, CVSS 9.1), and CVE-2026-58644 (RCE, CVSS 9.8). Tenable confirms active exploitation of all five, and CISA added CVE-2026-58644 to KEV on July 17, making this the fourth KEV entry in the cluster. Post-exploitation includes IIS machine key theft and malware persistence; Microsoft and CISA released AMSI and Defender Antivirus detection signatures for three of the flaws.
SharePoint 2016 and 2019 reached end of extended support on July 14 with no ESU path, so unpatched instances are permanently exposed. The chain allows unauthorized access followed by privilege escalation and authenticated RCE, meaning a single exposed server yields full control plus persistent access through stolen machine keys. This is distinct from routine vulnerability churn because the exploitation is confirmed across all versions, the KEV footprint is expanding (four CVEs and counting), and the support lifecycle gap eliminates the standard remediation timeline.
Enable AMSI Full Mode, apply the specific Microsoft hotfixes covering CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-55040, and CVE-2026-58644, restrict internet-facing SharePoint exposure, and audit for published detection signatures. Before rotating IIS machine keys, scan for machine key harvesting artifacts as CISA advises. Hunt for the AMSI and Defender telemetry fields referenced in the Microsoft signatures and monitor for IIS key theft indicators in server logs.
Watch for a fifth KEV addition or an expansion beyond on-premises SharePoint to SharePoint Online or related Microsoft server products. Also watch for published IoCs or actor attribution linking this cluster to a specific threat group, which would shift defensive prioritization.
Timeline
-
original reporting
Microsoft SharePoint Exploitation — Fourth KEV Entry, Tenable Confirms Five-CVE Active Exploitation Cluster
tenable.com · 89d ago · July 17th, 2026
Previously covered July 14-16. New: CISA adds CVE-2026-58644 to KEV; Tenable publishes comprehensive FAQ confirming four actively exploited CVEs with a fifth (CVE-2026-58644) newly confirmed exploited; post-exploitation activity includes IIS machine key theft and malware deployment.
Tenable's Research Special Operations team has published a comprehensive FAQ on the SharePoint exploitation cluster, confirming that attackers are chaining multiple vulnerabilities for unauthorized access, RCE, IIS machine key theft, and malware persistence. The five CVEs form a layered attack surface: CVE-2026-32201 (spoofing, CVSS 6.5) for initial access, CVE-2026-45659 (RCE, CVSS 8.8) for code execution, CVE-2026-56164 (EoP, CVSS 9.8 per NVD) for privilege escalation, CVE-2026-55040 (auth bypass, CVSS 9.1) as a chain enabler, and CVE-2026-58644 (RCE, CVSS 9.8) for authenticated code execution.
Microsoft and CISA have published AMSI and Defender Antivirus detection signatures for three of the actively exploited flaws. CISA recommends scanning for machine key harvesting artifacts before rotating IIS machine keys.
Action: This is now a four-CVE KEV cluster with active exploitation confirmed across all on-premises SharePoint versions. SharePoint 2016/2019 reached end of extended support on July 14 — no ESU available. Enable AMSI Full Mode, restrict internet exposure, and audit for the published detection signatures.