Intranet Intrusion CISA Warns of SharePoint Vulnerability Chain Used to Hijack IIS Machine Keys

Intranet Intrusion: CISA Warns of SharePoint Vulnerability Chain Used to Hijack IIS Machine Keys

Executive Summary

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory warning that threat actors are actively exploiting a chain of vulnerabilities in on-premises versions of Microsoft SharePoint Server. The active campaign combines three separate flaws—including a maximum-severity privilege escalation zero-day patched in July's Patch Tuesday—to bypass authentication boundaries, perform remote code execution, and extract sensitive Internet Information Services (IIS) machine keys. Armed with these keys, attackers can bypass security controls to establish persistent administrative access and plant stealthy backdoors inside corporate networks.

Technical Analysis of the SharePoint Exploit Chain

The active campaign relies on chaining three distinct vulnerabilities within Microsoft SharePoint Server's web application architecture to achieve full system compromise:

1. The Spoofing Footprint (CVE-2026-32201)

* Vulnerability Class: Improper Input Validation (CWE-20)

* Mechanics: Originally disclosed in April 2026, this vulnerability allows a remote, unauthenticated attacker to exploit improper input validation boundaries in SharePoint's API endpoints. By sending crafted web requests, the attacker can perform network-level spoofing, tricking the server into routing traffic as if it originated from a trusted internal node.

2. The Deserialization Payload (CVE-2026-45659)

* Vulnerability Class: Deserialization of Untrusted Data (CWE-502)

* Severity Score: 8.8 (High)

* Mechanics: Once a spoofed foothold is established, the attacker targets SharePoint's backend document processing engine. By injecting a serialized, untrusted data payload, the attacker abuses the server's XML/object deserialization routines to execute arbitrary commands under the execution context of the SharePoint application pool.

3. The Privilege Escalation Escalator (CVE-2026-56164)

* Vulnerability Class: Elevation of Privilege (EoP) (CWE-269)

* Mechanics: Released during the July 2026 Patch Tuesday, this vulnerability allows a low-privilege SharePoint user (or an attacker who has established a foothold via the previous two steps) to elevate their execution context over the network.

The Ultimate Impact: IIS Machine Key Theft

By chaining these flaws, the attackers gain the administrative privileges necessary to access the server's underlying IIS web configuration. The primary goal of the threat actors is the extraction of the server's IIS machine keys. These cryptographic keys are used to encrypt and sign view state data, forms, and session cookies. Once the attackers exfiltrate the machine keys, they can:

* Forge administrative session state cookies at will from any external machine.

* Securely bypass standard authentication filters and MFA checks on any web portal hosted by that IIS instance.

* Achieve permanent, persistent access that survives standard server reboots and password resets.