CISA warns admins to patch actively exploited SharePoint flaws

CISA warns that attackers are actively exploiting three critical SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) enabling authentication bypass, remote code execution, and post-exploitation actions such as stealing IIS machine keys and establishing persistence. The advisory notes thousands of Internet-exposed SharePoint instances (Shadowserver: ~10,000) with hundreds unpatched, adds the flaws to CISA's Known Exploited Vulnerabilities Catalog, and urges immediate patching, monitoring, AMSI/MDAV use, access restrictions, and other hardening steps; federal agencies were given a remediation deadline under BOD 26-04.