Intranet Intrusion: CISA Warns of SharePoint Vulnerability Chain Used to Hijack IIS Machine Keys
Executive Summary
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory warning that threat actors are actively exploiting a chain of vulnerabilities in on-premises versions of Microsoft SharePoint Server. The active campaign combines three separate flaws—including a maximum-severity privilege escalation zero-day patched in July's Patch Tuesday—to bypass authentication boundaries, perform remote code execution, and extract sensitive Internet Information Services (IIS) machine keys. Armed with these keys, attackers can bypass security controls to establish persistent administrative access and plant stealthy backdoors inside corporate networks.
Technical Analysis of the SharePoint Exploit Chain
The active campaign relies on chaining three distinct vulnerabilities within Microsoft SharePoint Server's web application architecture to achieve full system compromise:
1. The Spoofing Footprint (CVE-2026-32201)
* Vulnerability Class: Improper Input Validation (CWE-20)
* Mechanics: Originally disclosed in April 2026, this vulnerability allows a remote, unauthenticated attacker to exploit improper input validation boundaries in SharePoint's API endpoints. By sending crafted web requests, the attacker can perform network-level spoofing, tricking the server into routing traffic as if it originated from a trusted internal node.
2. The Deserialization Payload (CVE-2026-45659)
* Vulnerability Class: Deserialization of Untrusted Data (CWE-502)
* Severity Score: 8.8 (High)
* Mechanics: Once a spoofed foothold is established, the attacker targets SharePoint's backend document processing engine. By injecting a serialized, untrusted data payload, the attacker abuses the server's XML/object deserialization routines to execute arbitrary commands under the execution context of the SharePoint application pool.
3. The Privilege Escalation Escalator (CVE-2026-56164)
* Vulnerability Class: Elevation of Privilege (EoP) (CWE-269)
* Mechanics: Released during the July 2026 Patch Tuesday, this vulnerability allows a low-privilege SharePoint user (or an attacker who has established a foothold via the previous two steps) to elevate their execution context over the network.
The Ultimate Impact: IIS Machine Key Theft
By chaining these flaws, the attackers gain the administrative privileges necessary to access the server's underlying IIS web configuration. The primary goal of the threat actors is the extraction of the server's IIS machine keys. These cryptographic keys are used to encrypt and sign view state data, forms, and session cookies. Once the attackers exfiltrate the machine keys, they can:
* Forge administrative session state cookies at will from any external machine.
* Securely bypass standard authentication filters and MFA checks on any web portal hosted by that IIS instance.
* Achieve permanent, persistent access that survives standard server reboots and password resets.
Category
Details
Target Software
On-Premises Microsoft SharePoint Server (2019, Subscription Edition)
Vulnerability Identifiers
CVE-2026-32201 (Spoofing), CVE-2026-45659 (Deserialization), and CVE-2026-56164 (EoP)
Campaign Objective
IIS Machine Key Theft, Persistent Backdooring, and Malware Delivery
Mitigation Deadline
Immediate (Urgent CISA KEV Directive)
Threat Landscape and Intranet Risks
SharePoint servers are the focal point of corporate document collaboration, storing sensitive intellectual property, internal financial records, and operational guides. Because SharePoint is deeply integrated with Active Directory and corporate databases, a compromised SharePoint server serves as an ideal pivot point for attackers to compromise the entire corporate intranet, rendering outer perimeter defenses ineffective.
Recommendations and Mitigations
Enterprise administrators managing on-premises SharePoint Server deployments must execute the following emergency remediation steps:
1. Deploy July 2026 Cumulative Patches Immediately: Apply the security updates addressing CVE-2026-56164 and the companion SharePoint flaws. Ensure all web front-end and application servers in the SharePoint farm are updated.
2. Cycle IIS Machine Keys: If you detect any signs of compromise or unauthorized access, apply the patches, and then immediately generate and cycle new IIS machine keys across all web application pools to invalidate any forged cookies or sessions held by the attackers.
3. Restrict Network Lateral Communication: Enforce strict network segmentation, preventing your SharePoint web front-end servers from communicating with sensitive internal databases or domain controllers over unapproved ports.
4. Implement Web Application Firewall (WAF) Rules: Configure your WAF to block malformed incoming serialization streams and unexpected POST requests targeting SharePoint's core administrative directories.
Verification of Compliance:
Report remediation status to Person no later than Date.