One Malicious Web Request Can Turn an Exposed SharePoint Server Into a Persistent Backdoor

A newly disclosed cluster of Microsoft SharePoint Server vulnerabilities is actively being exploited in the wild, allowing attackers to convert a single crafted web request into full remote code execution and long-term persistence across enterprise environments.

Security updates released in July 2026, alongside a CISA advisory, confirm that multiple vulnerabilities are already being weaponized against on-premises deployments.

The vulnerabilities tracked as CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, signaling confirmed in-the-wild abuse.

Additional high-impact issues, including CVE-2026-58644, CVE-2026-55040, and CVE-2026-50522, significantly expand the unauthenticated attack surface and are expected to accelerate exploitation activity.

Microsoft has released patches for all supported versions, including SharePoint Server 2016, 2019, and Subscription Edition.

At the core of the threat is the ability to chain multiple weaknesses into a seamless attack path. An unauthenticated attacker can exploit improper input validation and authentication bypass to reach sensitive endpoints, then exploit unsafe deserialization vulnerabilities to execute arbitrary code within the IIS worker process.

In observed attacks, threat actors deploy ASP.NET web shells such as spinstall0.aspx to establish an initial foothold and begin post-exploitation activities.

One particularly dangerous technique involves extracting ASP.NET machine keys from the SharePoint configuration. These cryptographic keys are used to sign and encrypt ViewState and authentication tokens.

Once stolen, they allow attackers to generate trusted payloads that the server will accept as legitimate, effectively bypassing security controls even after patching. This transforms a one-time exploit into a persistent backdoor that survives remediation efforts.

Security researchers and incident response teams have observed attackers leveraging this access to install malicious IIS modules, execute PowerShell commands via encoded payloads, and pivot laterally into backend systems.

Because SharePoint is deeply integrated with Active Directory and SQL Server, a compromised Web Front-End server can quickly lead to domain-level access, database exfiltration, and broader infrastructure compromise.

The attack chain aligns with tactics commonly associated with both nation-state actors and ransomware affiliates. Initial access brokers are also likely to exploit these vulnerabilities to gain entry into high-value enterprise networks.

According to CISA’s advisory published on July 14, 2026, organizations with internet-exposed SharePoint servers are at highest risk, particularly those running outdated builds or hosting sensitive data repositories.

Microsoft SharePoint Server vulnerabilities

Technical analysis shows that exploitation often begins with reconnaissance using tools like Shodan or Censys to identify exposed SharePoint endpoints.

Attackers then send crafted HTTP POST requests to vulnerable paths such as /_layouts/15/ToolPane.aspx, sometimes spoofing headers like Referer to bypass security checks.

Successful exploitation is typically followed by suspicious process activity, including w3wp.exe spawning command shells or PowerShell instances.

Microsoft’s mitigation guidance emphasizes immediate patching using updates such as KB5002882, KB5002883, and KB5002891.

Organizations are also advised to enable AMSI integration with full request body scanning, restrict external access to SharePoint servers, and monitor IIS logs for anomalous requests and module changes.

Notably, SharePoint Online and Microsoft 365 environments are not affected, as they are managed by Microsoft.

This vulnerability cluster highlights a recurring pattern in enterprise attacks: the chaining of moderate vulnerabilities into critical compromise paths.

In this case, what begins as a single malicious web request can escalate into persistent, stealthy access across an entire organization.

With active exploitation confirmed and public proof-of-concept techniques emerging, defenders should assume compromise in unpatched environments and prioritize threat hunting, credential rotation, and forensic validation.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide