Breaking: SharePoint Attack Chain Escalates to Domain Compromise via Web Shells and IIS Key Theft — 20 July 2026

SharePoint Under Siege: Active Attacks Chain RCE, Web Shells, and IIS Key Theft for Domain Compromise

A new Resecurity analysis published today confirms what CISA's rapid KEV additions already signalled: the July 2026 SharePoint vulnerability cluster is not a patch-and-move-on event. Attackers are chaining three actively exploited CVEs into a full compromise pipeline that starts with an unauthenticated web request and ends with domain-level control, persistent web shell access, and stolen IIS cryptographic keys that survive patching.

Three CVEs sit at the centre of the attack chain now confirmed in the wild. CVE-2026-56164 (CVSS 9.8) is a missing authentication flaw that lets unauthenticated attackers reach critical SharePoint functions directly. CVE-2026-45659 (CVSS 8.8) is a deserialization vulnerability allowing authenticated attackers with Site Member privileges to execute arbitrary code remotely. CVE-2026-32201 (CVSS 6.5) provides improper input validation that enables privilege escalation from Site Member to Site Owner. When chained, an attacker can bypass authentication, elevate privileges, and achieve remote code execution without needing valid credentials at all.

Resecurity's report documents the attack chain in detail. After achieving RCE, threat actors deploy persistent web shells, specifically a variant named spinstall0.aspx, which extracts the machineKey element from SharePoint's web.config file. This IIS machine key is used to sign and encrypt ASP.NET view state and session data. Once stolen, an attacker can forge authentication tokens that persist even after the original vulnerability is patched, because simply applying the Microsoft update does not rotate the compromised key material. The stolen keys also enable lateral movement into SQL Server, Active Directory-connected resources, and other IIS applications sharing the same machine key.

Three additional SharePoint CVEs disclosed in the same patch cycle expand the attack surface further, even though they are not yet listed on KEV for active exploitation. CVE-2026-58644 (CVSS 9.8) is another unauthenticated deserialization RCE. CVE-2026-50522 (CVSS 9.8) is a second unauthenticated deserialization flaw. CVE-2026-55040 (CVSS 9.1) bypasses JWT authentication. Any one of these on its own would warrant emergency patching. All three in the same month, alongside three already-exploited vulnerabilities, turns this from a vulnerability management exercise into an active incident response situation.

CISA's BOD 26-04 deadlines have already passed for the first three: CVE-2026-56164 was due July 17, and the SharePoint and FortiSandbox additions from July 16 carried a July 19 deadline. If you run on-premises SharePoint and have not patched yet, you are now outside the compliance window and, more importantly, in the exploitation window.

The threat actor profile fits both nation-state and ransomware affiliate patterns. CISA attributes activity to "malicious cyber threat actors" without naming a specific group, but the TTPs (SharePoint exploitation, web shell deployment, machineKey theft, IIS module persistence) align with both espionage operators seeking long-term access and initial access brokers selling footholds to ransomware groups.

SharePoint Online and Microsoft 365 environments are not affected. This is an on-premises problem. Affected versions are SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016.

So what / Action: Patch immediately if you have not already. Then go further. Enable AMSI integration on every SharePoint web application. Hunt for spinstall0.aspx and any unexpected .aspx files in your SharePoint virtual directories. Check IIS logs for anomalous POST requests to SharePoint application pages. Crucially, after patching, rotate the IIS machineKey in web.config on every SharePoint server. A patch without a key rotation leaves the persistence door open. If you find indicators of compromise, assume domain-level compromise and scope your incident response accordingly. The attack chain is fast, the persistence is durable, and the window between patch availability and active exploitation has closed.