SharePoint Zero-Days Weaponized to Harvest IIS Machine Keys for Persistent Farm Control
Executive Summary
Sophisticated threat actors are actively exploiting a cluster of zero-day vulnerabilities in on-premises Microsoft SharePoint Server—including unauthenticated privilege escalation flaw CVE-2026-56164 and authentication bypass CVE-2026-55040—to harvest Internet Information Services (IIS) machine keys and gain complete Farm Administrator control.
By stealing IIS machine keys, attackers obtain the cryptographic material required to forge trusted ASP.NET ViewState payloads, allowing them to retain persistent administrative execution on fully patched SharePoint servers long after vulnerability updates are applied. CISA has added the exploited flaws to its KEV Catalog, urging immediate mitigation.
Deep-Dive Technical Analysis
The attack chain begins when remote, unauthenticated attackers exploit CVE-2026-55040 or CVE-2026-56164 on internet-exposed SharePoint 2016, 2019, or Subscription Edition servers. These initial access vulnerabilities allow attackers to bypass front-end authentication checks and assume the identity of a site administrator.
Once an initial foothold is established, threat actors chain deserialization vulnerabilities (such as CVE-2026-50522 and CVE-2026-58644) to execute arbitrary code within the IIS worker process (w3wp.exe) context.
The primary post-exploitation objective in these campaigns is the extraction of IIS machine keys stored within the server's web.config files or memory. SharePoint uses IIS machine keys to validate and decrypt ASP.NET ViewState data sent between client browsers and the server. Armed with the stolen validation and decryption keys, attackers can generate arbitrary, cryptographically valid ViewState payloads containing malicious deserialization commands.
Because the ViewState payload appears cryptographically legitimate, the SharePoint server trusts and executes it without raising authentication alarms. This enables attackers to maintain covert, persistent Farm Administrator access across all web front-ends in the SharePoint farm—bypassing security patches and surviving server reboots.
Industry Impact
Microsoft SharePoint Server remains a core collaboration hub for government agencies, financial institutions, and healthcare providers. The ability of attackers to survive security patches by leveraging stolen machine keys presents an alarming challenge for enterprise security teams.
Standard patch management workflows are insufficient against this technique; even after applying official Microsoft updates, compromised servers remain fully accessible to attackers who hold the IIS machine keys.
Mitigation Strategies & Recommendations
Security administrators are advised to move beyond standard patching to address the persistence mechanisms utilized in these campaigns.
Strategy
Action Items
Patch & Rotate
Apply the latest Microsoft SharePoint security updates immediately and forcefully rotate all IIS machine keys across the entire SharePoint farm.
Credential Management
Reset passwords for all SharePoint Farm Service Accounts, Application Pool identities, and associated Active Directory service accounts.
Configuration Audit
Audit all web.config instances on SharePoint web front-ends for unauthorized modifications or web shell injections.
ViewState Security
Verify that enableViewStateMac and ViewState encryption are strictly enforced across all web applications.
Access Control
Place on-premises SharePoint farms behind Web Application Firewalls (WAF) with strict deserialization rules and restrict direct internet exposure of administrative endpoints.
Analyst: Person
Review Date: Date