SharePoint: 4 CVEs Added to CISA KEV in 3 Weeks — Unauthenticated RCE Chain

Between July 1 and July 22, 2026, CISA added four Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities catalog. Four KEV entries on a single product in three weeks, with mandated remediation deadlines of three days, is not statistical noise — it's the signature of an active exploitation campaign against on-premises SharePoint deployments.

The most instructive item in the batch isn't the 9.8 — it's the 5.3. Its presence in KEV is a textbook demonstration of why CVSS should never be your sole prioritisation criterion.

The 4 CVEs

The first three were published on the same day (July 14, 2026), matching a Patch Tuesday batch. KEV additions then rolled out over three weeks, tracking observed exploitation.

Technical Details

The two deserializations (CVE-2026-50522 and CVE-2026-58644)

Microsoft remains characteristically terse. The NVD text is identical for both:

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Vector for both: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network, low complexity, no authentication, no user interaction, maximum impact across all three axes.

Microsoft hasn't published the precise mechanism, but the vulnerability class is well documented on the SharePoint stack. SharePoint is an ASP.NET application, and exploitable deserializations there classically come from:

• __VIEWSTATE — if the machine keys (validationKey / decryptionKey) are known or MAC validation is bypassed, an attacker forges a ViewState carrying a .NET gadget chain and gains code execution in the IIS worker
• BinaryFormatter / LosFormatter / ObjectStateFormatter invoked on client-controlled data
• SharePoint web service endpoints accepting deserialized XML/SOAP payloads

The result is code execution in the IIS application pool context — often a domain service account with broad rights.

The 5.3 that matters more than its score (CVE-2026-56164)

Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N → no confidentiality impact, low integrity impact, no availability impact. Hence the 5.3.

Taken alone, this CVE genuinely doesn't achieve much. Chained, it changes everything: it supplies exactly the unauthenticated access primitive a deserialization needs when the latter would otherwise require a valid session. This is the classic SharePoint attack shape — a low-scoring auth bypass followed by a high-impact deserialization.

It's also why it was the first one added to KEV (July 14): defenders saw it used upstream in the observed chains.

CVE-2026-45659

Added as early as July 1. The KEV text specifies "allows an authorized attacker to execute code over a network" — so authentication is required. NVD data (score, vector, versions) isn't exposed at the time of writing. Treat it with the same seriousness as the others: a standard SharePoint account is trivial to obtain in a mid-sized organisation.

Affected Products and Versions

NVD data references, for the three documented CVEs:

⚠️ These are the version boundaries as exposed by NVD, not necessarily the patch number to install. Refer to the Microsoft bulletin for the exact KB matching your version and branch.

SharePoint Online (Microsoft 365) is not affected — Microsoft patches service-side. The risk sits with on-premises deployments (SharePoint Server 2016, 2019, Subscription Edition).

Exploitation and Impact

Why SharePoint is a prime target

On-premises SharePoint combines three properties that make it attractive:

1. Frequent internet exposure — extranet portals, partner spaces and remote-work intranets are often published directly
2. High-value content — contracts, HR data, intellectual property, strategic plans
3. Deep Active Directory integration — the application pool typically runs under a domain service account, sometimes over-privileged

Typical attack chain

1. Recon: identify an internet-exposed on-prem SharePoint instance
2. Authentication bypass via CVE-2026-56164 to reach a normally protected endpoint
3. Deserialization (CVE-2026-50522 or CVE-2026-58644) → code execution in the IIS worker
4. Machine key theft (web.config) — enables forging valid ViewStates at will, i.e. persistence that survives patching
5. Extract service account credentials, then pivot into Active Directory
6. Drop webshells into _layouts directories for durable access

Step 4 is the one teams consistently miss: patching is not enough if the machine keys leaked. They must be rotated.

Detection and IOCs

IIS logs

Look for POSTs to endpoints historically targeted on SharePoint:

# On the SharePoint server (PowerShell)
Select-String -Path "C:\inetpub\logs\LogFiles\W3SVC*\*.log" `
  -Pattern "ToolPane|_layouts/15/.*\.aspx.*POST|__VIEWSTATE" |
  Select-Object -Last 100

Signals to correlate:

• POST requests with abnormally large __VIEWSTATE
• 200 responses on _layouts endpoints from unexpected external IPs
• Missing or forged Referer on administrative requests

Dropped files

# Recent .aspx files in SharePoint directories
Get-ChildItem "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS" `
  -Recurse -Include *.aspx |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-45) }

Any .aspx appearing recently without a corresponding maintenance operation should be treated as a webshell.

Suspicious child processes

The IIS worker (w3wp.exe) should never spawn a shell:

Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 500 |
  Where-Object { $_.Message -match "ParentImage:.*w3wp\.exe" -and
                 $_.Message -match "cmd\.exe|powershell\.exe" }

This is the most reliable indicator of successful exploitation.

Mitigation and Patch

1. Apply the Microsoft updates

All four CVEs are fixed by the July 2026 security updates. On every farm server:

Install-WindowsUpdate -Category SecurityUpdates -AcceptAll

Then run the SharePoint Products Configuration Wizard (psconfig) on each farm server, in order — a SharePoint update not finalised with psconfig leaves the farm in an inconsistent state.

2. Rotate machine keys (mandatory)

If your farm was exposed during the exploitation window, treat the machine keys as compromised:

Update-SPMachineKey -WebApplication "https://sharepoint.example.com"
Restart-Service W3SVC

Without this step, an attacker who already exfiltrated the keys retains the ability to forge valid ViewStates after patching.

3. Reduce exposure

• Remove direct internet access to the on-prem portal: place it behind an authenticating reverse proxy, a VPN, or Entra ID Application Proxy
• Restrict the application pool service account to least privilege
• Enable AMSI for SharePoint if your version supports it

4. Retroactive hunt

The CISA deadlines (3 days) indicate active exploitation since early July. If you patched after July 20, run a hunt: webshells, newly created farm accounts, scheduled tasks, unusual outbound connections from SharePoint servers.

Why Continuous Monitoring of Your Microsoft Estate Matters

This episode exposes two classic blind spots. First, CVSS alone prioritises badly: the 5.3 was the most urgent item because it opened the chain. Second, KEV listing lags patch publication — by up to three weeks here. An organisation that tracks only scores, or waits for the CISA alert, patches systematically too late.

With cveo.tech, inventory your SharePoint, Exchange and Windows servers and get automatic alerts whenever a CVE hits one of your exact versions — with KEV status surfaced up front, so you prioritise on real-world exploitation rather than score alone.