SharePoint Server in KEV: five CVEs from April to August 2026

On-premises SharePoint spent the summer of 2026 on CISA's Known Exploited Vulnerabilities list. Tenable's write-up describes attackers chaining three SharePoint bugs to get in, pulling IIS machine keys, using deserialization for persistence and dropping malware. This post pulls the dates and builds into one place so you can check your farm against them.

The July 14, 2026 Patch Tuesday brought two of the newest: CVE-2026-56164, added to KEV that same day, and CVE-2026-58644, which Microsoft flagged as exploited on 15 July.

What's affected

All of these affect SharePoint Server Subscription Edition, 2019 and 2016 on premises. SharePoint Online is not part of this list. The table combines CISA's catalog dates with Tenable's summary of builds and types.

CVE-2026-50522 was also added to KEV on 22 July, but I could not confirm its details from a primary source, so it is left out of the table.

Two notes on the data. CVE-2026-55040 was not observed exploited when Tenable wrote on 16 July, and CISA listed it a month later, so "not yet exploited" lasted about five weeks. And scores disagree: CVE-2026-56164 is 9.8 at NVD and 5.3 in Microsoft's own rating.

How the chain worked

Tenable's account of the attacks puts three bugs in sequence: CVE-2026-32201 for an unauthenticated foothold, CVE-2026-45659 for code execution through deserialization, and CVE-2026-56164 for elevation of privilege. After that the attackers extracted IIS machine keys. A machine key signs and protects view state and similar data, so possessing it lets an attacker craft requests the farm accepts as genuine. The deserialization bugs then give a way to stay in place and drop malware.

That is why the key point in CISA's guidance matters: a patched server can still be compromised if the keys were already taken. Patching closes the door. It does not recover what left through it.

The Dutch NCSC notes that CVE-2026-58644 could be chained with CVE-2026-56164 to run code without authentication. That is described as a possibility, not a confirmed attack chain, so treat it as a reason to patch both together and not as a reported incident.

How to check if you're exposed

On a farm server, in the SharePoint Management Shell:

(Get-SPFarm).BuildVersion

Compare the result with the fixed build for your edition. A build below the figure for CVE-2026-56164 means you are exposed to that bug, and likely the earlier ones too. Check every server in the farm, since builds can differ after a half finished update.

Then check protection and exposure:

• Is AMSI integration enabled for SharePoint and the IIS worker processes, with Request Body Scan mode set to Full?
• Is Central Administration reachable from outside?
• Is the farm itself published to the internet when it does not need to be?

What to do now

1. Install the cumulative updates for your edition, covering every build in the table.
2. Turn on AMSI integration and set Request Body Scan to Full, and keep Defender or another endpoint product current.
3. Hunt for the Defender detection names Tenable lists, such as Backdoor:MSIL/LeakFang.A!dha (machine key access) and the ToolPaneAuthBypass signatures.
4. If you suspect compromise, remove any machine key harvesting artifacts before rotating keys. CISA's guidance, as relayed by Tenable, is that rotating alone is not enough.
5. Take Central Administration and the farm off the internet unless there is a documented need.

How this could have been avoided

• Do not publish on-premises SharePoint directly. An authentication proxy or VPN removes unauthenticated attacks, which three of these bugs use.
• Patch monthly and verify the build number. Exploitation followed fixes quickly, so a missed update matters. Checking BuildVersion on every server finds half applied patches.
• Scan request bodies with AMSI. The AMSI signatures named above can block known exploit requests before they run.
• Treat machine keys as secrets that leak. The attackers extracted them to forge valid requests later. Rotation after cleanup, and monitoring for key access, limits that.
• Limit who is a Site Owner. CVE-2026-58644 needs that permission level, so tighter ownership shrinks the group who can try it.

Why it matters

A single product on a single list five times in four months tells you where to put effort. Patching after the third listing is already late. The more useful habit is a per-product watch: when a product you run appears twice in KEV, move it from the monthly queue to the weekly one.

Reading a fix table without getting lost

SharePoint's three editions use different build numbers, so one CVE has three "fixed" values. A farm is safe against a bug only when every server reaches the fixed build for its edition. Two habits help.

First, record the target build per edition in your change ticket, not just "install the July update". Second, check each server after the update with the shell command above, and record the number it returns in the ticket.

Microsoft's severity and NVD's differ for CVE-2026-56164, 5.3 against 9.8. Do not let that gap decide urgency. The catalog entry is the stronger signal.

Try it yourself

Pick one product you run and count how many of its CVEs appear in the KEV catalog. The catalog is a public JSON file, and the Gold KEV list shows the same status in a browsable form.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Tenable: SharePoint Server exploitation FAQ
• NVD: CVE-2026-58644
• NVD: CVE-2026-45659
• CISA Known Exploited Vulnerabilities catalog