Microsoft SharePoint Vulnerabilities Actively Exploited for RCE, Web Shells, and IIS Key Theft

This report details active exploitation of multiple SharePoint Server vulnerabilities (including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) enabling remote code execution, web shell deployment, theft of ASP.NET machineKey values, and installation of malicious IIS modules; attackers can use these footholds to move from a compromised internet-facing SharePoint server to databases, IIS, and Active Directory resources. The report includes IoCs, detection and hardening recommendations (patching, AMSI full-body scans, log review, isolation, credential resets), and notes the issues are listed in CISA’s Known Exploited Vulnerabilities catalog.