CISA KEV Alert: Active Exploitation of SharePoint CVE-2026-58644 to Steal IIS Machine Keys and Establish Stealthy Persistence
Executive Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory warning of the active, in-the-wild exploitation of a newly disclosed security vulnerability affecting on-premises Microsoft SharePoint deployments. Added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog on July 16, 2026, the vulnerability—tracked as CVE-2026-58644—impacts all supported versions of Microsoft SharePoint Server (including Subscription Edition, 2019, and 2016). In active exploitation campaigns, sophisticated cyber threat actors are chaining CVE-2026-58644 with other SharePoint flaws to execute remote code, exfiltrate critical Internet Information Services (IIS) machine keys, and deploy highly evasive .NET deserialization techniques to achieve persistent, stealthy administrative access.
Deep-Dive Technical Analysis
Microsoft SharePoint Server relies extensively on Microsoft's Internet Information Services (IIS) web server and the .NET Framework to compile, render, and coordinate web requests. To secure user sessions, encrypt ViewState data, and sign authentication cookies, IIS utilizes pre-configured, highly sensitive cryptographic secrets known as IIS machine keys (specifically the validation key and decryption key). If these machine keys are exfiltrated, the entire security perimeter of the IIS-hosted application is compromised, enabling attackers to forge arbitrary authentication cookies and execute arbitrary code.
A technical and forensic analysis of the CVE-2026-58644 exploitation lifecycle reveals a highly sophisticated post-compromise manipulation chain:
1. The Entry Vector (Chaining Remote Code Execution): Attackers initiate their intrusion by exploiting a separate, unauthenticated or low-privilege SharePoint vulnerability (such as CVE-2026-56164) to execute arbitrary code within the context of the IIS application pool.
2. Exfiltrating the IIS Machine Keys (CVE-2026-58644): Once code execution is established under the limited w3wp.exe worker process, the attackers exploit CVE-2026-58644. This vulnerability resides within SharePoint's internal administrative and configuration-parsing endpoints. By executing a malformed local query, the limited-privilege process can bypass security access controls and read the core IIS Web.config configuration files, directly exfiltrating the unencrypted IIS machine validation and decryption keys.
3. Establishing Persistent Deserialization Backdoors: Armed with the stolen IIS machine keys, the attackers no longer need to exploit software bugs to communicate with the server. They utilize the keys to cryptographically sign malformed, serialized .NET ViewState payloads. When transmitted to any SharePoint endpoint, the server decrypts and deserializes the payload, automatically executing the embedded commands.
4. Deploying Stealthy Web Shells and Malware: Because the malicious commands are executed directly within the memory space of the trusted IIS deserialization engine, they bypass traditional, signature-based file scanners, allowing the threat actors to deploy stealthy .NET web shells (such as those associated with advanced persistent threat groups) and establish long-term persistence.
The active exploitation of CVE-2026-58644 to harvest cryptographic secrets poses a severe, immediate threat to the confidentiality and integrity of all on-premises SharePoint deployments.
Industry Impact and Recommendations
The SharePoint CVE-2026-58644 campaign demonstrates that achieving initial code execution is frequently only the first step in a sophisticated attack chain. By targeting the cryptographic foundation of the web server (the IIS machine keys), threat actors can establish persistent, memory-only backdoors that are exceptionally difficult to detect and eradicate.
We recommend that all system administrators, Windows engineers, and corporate SecOps teams implement the following immediate mitigations:
1. Apply the July 2026 SharePoint Security Updates Immediately: Test and deploy the Microsoft SharePoint security updates released this week to remediate CVE-2026-58644. Prioritize on-premises installations hosting business-critical or public-facing portals.
2. Re-Generate and Rotate Your IIS Machine Keys: For any SharePoint server suspected of being compromised or running vulnerable software versions prior to patching, immediately re-generate and rotate all IIS machine keys. This invalidates any previously exfiltrated keys and neutralizes active ViewState deserialization exploits.
3. Enable SharePoint AMSI body Scanning: Configure Microsoft's Antimalware Scan Interface (AMSI) on the SharePoint server and set the Request Body Scan mode to "Full" to actively detect, analyze, and block malformed, serialized POST requests before they are parsed by the IIS engine.
4. Restrict Outbound Network Communications: Configure firewalls to strictly block all unauthorized outbound network connections originating from SharePoint server subnets, preventing compromised IIS worker processes from communicating with external command-and-control (C2) servers.
References
* CISA — CISA Urges SharePoint Hardening After New Exploitations
* Bleeping Computer — Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days