One Malicious Web Request Can Turn an Exposed SharePoint Server Into a Persistent Backdoor

Critical SharePoint Server vulnerabilities (multiple CVEs, including ones listed in CISA’s KEV catalog) are being actively exploited in the wild to convert a single crafted web request into unauthenticated remote code execution and persistent backdoors across on‑premises environments. Attackers deploy ASP.NET web shells (e.g., spinstall0.aspx), extract machine keys to forge trusted payloads, install malicious IIS modules, execute encoded PowerShell, and pivot to Active Directory and SQL Server; Microsoft has released patches for supported versions and CISA has issued mitigation guidance, so organizations with internet‑exposed SharePoint should assume compromise in unpatched environments and prioritize patching, threat hunting, credential rotation, and forensic validation.