--- schema: 1 kind: vulnerability title: > Microsoft July 2026 Patch Tuesday ships two actively-exploited zero-days — AD FS local EoP (CVE-2026-56155) and unauthenticated SharePoint EoP (CVE-2026-56164) headline: > Microsoft patches two exploited zero-days on-prem: an AD FS privilege escalation and an unauthenticated SharePoint EoP, both KEV-listed same day summary: > Microsoft's July 2026 Patch Tuesday (its largest ever by CVE count) fixes two zero-days Microsoft confirms were exploited in the wild and CISA added to KEV the same day: CVE-2026-56155, a local elevation-of-privilege in Active Directory Federation Services (AD FS), and CVE-2026-56164, an unauthenticated, network-reachable elevation-of-privilege in on-prem SharePoint Server 2016/2019/Subscription Edition. Any organization running on-prem AD FS or SharePoint should treat both as emergency patches. discovered_at: "2026-07-14T20:19:53Z" updated_at: "2026-08-19T04:47:00Z" event_date: 2026-07-14 run_id: 2026-07-14T2009Z-intel priority: high immediate_action: null tags: - vulnerabilities - actively-exploited - zero-day - priv-esc - cisa-kev - identity - patch-available - rce - auth-bypass - pre-auth - poc-public regions: - global - europe - switzerland sectors: - public-sector - finance - healthcare - energy - telco - education - technology entities: - "incident:foitt-bit-sharepoint-breach-2026-07" - "incident:graubuenden-canton-sharepoint-breach-2026-08" techniques: - T1068 - T1190 - T1606 - T1552.004 - T1505.003 - T1211 - T1550.001 - T1087.002 - T1078 affected_products: - Microsoft Active Directory Federation Services - Microsoft SharePoint Server 2016 - Microsoft SharePoint Server 2019 - Microsoft SharePoint Server Subscription Edition - Microsoft Dynamics NAV - Microsoft Dynamics 365 Business Central (On-Premises) - Microsoft SharePoint Enterprise Server 2016 cves: - id: CVE-2026-56155 cvss: "7.8" epss: null type: priv-esc vector: local auth: post-auth status: - exploited - cisa-kev - patch-available affected: Windows Server 2012/2016/2019/2022/2025 with the AD FS role fixed: July 2026 cumulative update (KB5099445/5099535/5099536/5099538/5099540) - id: CVE-2026-56164 cvss: "5.3" epss: null type: priv-esc vector: zero-click auth: pre-auth status: - exploited - cisa-kev - patch-available affected: SharePoint Server 2016 / 2019 / Subscription Edition fixed: July 2026 SharePoint security updates - id: CVE-2026-55040 cvss: "9.1" epss: "0.0397" type: auth-bypass vector: zero-click auth: pre-auth status: - exploited - cisa-kev - poc-public - patch-available affected: > SharePoint Server Subscription Edition < 16.0.19725.20434; SharePoint Server 2019 < 16.0.10417.20175; SharePoint Enterprise Server 2016 < 16.0.5561.1001 fixed: > 16.0.19725.20434 (Subscription Edition); 16.0.10417.20175 (2019); 16.0.5561.1001 (Enterprise Server 2016) - id: CVE-2026-55944 cvss: "9.8" epss: null type: rce vector: zero-click auth: pre-auth status: - patch-available affected: Dynamics NAV / Dynamics 365 Business Central (On-Premises) fixed: July 2026 security update - id: CVE-2026-50522 cvss: "9.8" epss: null type: deserialization vector: zero-click auth: pre-auth status: - exploited - cisa-kev - poc-public - patch-available affected: SharePoint Server 2016 / 2019 / Subscription Edition (pre July 2026 update) fixed: July 2026 security update - id: CVE-2026-58644 cvss: "9.8" epss: null type: rce vector: zero-click auth: post-auth status: - exploited - cisa-kev - patch-available affected: > SharePoint Server Subscription Edition, 2019, 2016 (patched below the June 2026 cumulative update) fixed: June 2026 cumulative update - id: CVE-2026-63520 cvss: "8.1" epss: null type: rce vector: zero-click auth: pre-auth status: - patch-available affected: > Microsoft SharePoint Server Subscription Edition, 2019 and 2016 — see the MSRC record for the build detail fixed: August 2026 Patch Tuesday updates (released 2026-08-11) sources: - url: "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56155" publisher: Microsoft MSRC date: 2026-07-14 role: primary - url: "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56164" publisher: Microsoft MSRC date: 2026-07-14 role: primary - url: "https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review" publisher: Zero Day Initiative (Trend Micro) date: 2026-07-14 role: corroborating - url: "https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/" publisher: BleepingComputer date: 2026-07-14 role: corroborating - url: "https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/" publisher: Krebs on Security date: 2026-07-14 role: corroborating - url: "https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed" publisher: Rapid7 Labs (Stephen Fewer) date: 2026-07-14 role: primary - url: "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55944" publisher: Microsoft MSRC date: 2026-07-14 role: primary - url: "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50522" publisher: Microsoft MSRC date: 2026-07-14 role: corroborating - url: "https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations" publisher: CISA date: 2026-07-16 role: primary - url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644" publisher: Microsoft MSRC date: 2026-07-16 role: corroborating - url: "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0237" publisher: NCSC-NL date: 2026-07-21 role: primary - url: "https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/" publisher: BleepingComputer (relaying watchTowr) date: 2026-07-21 role: primary - url: "https://securityaffairs.com/195760/security/public-poc-triggers-active-exploitation-of-critical-sharepoint-rce-vulnerability-cve-2026-50522.html" publisher: Security Affairs date: 2026-07-21 role: corroborating - url: "https://www.rapid7.com/blog/post/em-patch-tuesday-august-2026/" publisher: Rapid7 date: 2026-08-11 role: primary - url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63520" publisher: Microsoft Security Response Center date: 2026-08-11 role: corroborating - url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040" publisher: Microsoft Security Response Center date: 2026-08-11 role: corroborating - url: "https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/" publisher: Rapid7 date: 2026-08-11 role: primary - url: "https://www.bleepingcomputer.com/news/microsoft/hackers-leverage-new-microsoft-sharepoint-exploit-in-attacks/" publisher: BleepingComputer date: 2026-08-12 role: corroborating - url: "https://security-hub.ncsc.admin.ch/#/posts/12764" publisher: NCSC-CH / GovCERT.ch Cyber Security Hub date: 2026-08-12 role: corroborating - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" publisher: "CISA Known Exploited Vulnerabilities catalog (feed, version 2026.08.18)" date: 2026-08-18 role: primary - url: "https://euvd.enisa.europa.eu/enisa/eu_vulnerability_database/EUVD-2026-44211" publisher: ENISA EU Vulnerability Database date: 2026-08-18 role: corroborating closed_sources: [] evidence: - quote: Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally. publisher: Microsoft MSRC - quote: Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. publisher: Microsoft MSRC - quote: "It's a missing-authentication flaw, meaning an unauthenticated attacker can hit it over the network with no user interaction required. When something this reachable is being actively abused, patch it now and worry about the score later." publisher: Zero Day Initiative (Trend Micro) - quote: "Patching CVE-2026-55040 will successfully break this exploit chain; this underscores the importance of patching vulnerabilities such as authentication bypasses, which can break complex and high-impact exploit chains." publisher: Rapid7 Labs - quote: Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network. publisher: Microsoft MSRC - quote: "CISA is aware of active exploitation of vulnerabilities CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522, and CVE-2026-55040, enabling cyber threat actors to gain unauthorized access to on-premises SharePoint Server instances." publisher: CISA - quote: "CISA has updated this Alert to reflect the addition of CVE-2026-58644 to its KEV Catalog on July 16, 2026." publisher: CISA - quote: "According to watchTowr, public exploit code for SharePoint vulnerability CVE-2026-50522 has been published and the vulnerability is now also being actively exploited on on-premise versions of SharePoint. Malicious actors can exploit this vulnerability to gain longer-term access to the networks of vulnerable systems by stealing machine keys. (translated from Dutch)" publisher: NCSC-NL (advisory NCSC-2026-0237) original: "Volgens watchTowr is er een publieke exploit code voor SharePoint kwetsbaarheid CVE-2026-50522 gepubliceerd en wordt deze op on-premise versies van SharePoint nu ook actief misbruikt. Kwaadwillenden kunnen deze kwetsbaarheid misbruiken om zichzelf voor langere termijn toegang tot netwerken van kwetsbare systemen te verschaffen, door middel van het stelen van machine-keys." - quote: "Within hours, our global honeypot network, Attacker Eye, captured exploitation attempts using this PoC that successfully compromised target systems." publisher: BleepingComputer (relaying watchTowr) - quote: allows a remote attacker to execute code over a network without authentication publisher: BleepingComputer - quote: "this vulnerability is the second in a pair of exploits which, when chained together, comprise a critical unauthenticated remote code execution vulnerability in a vulnerable SharePoint server" publisher: Rapid7 - quote: "Alongside today’s coordinated disclosure of CVE-2026-63520, Rapid7 has now published a detailed technical analysis and proof-of-concept for CVE-2026-55040, the first vulnerability in the chain." publisher: Rapid7 - quote: Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. publisher: Microsoft Security Response Center - quote: "The root cause is a chain of four distinct weaknesses that, when combined, allow an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user." publisher: Rapid7 - quote: "This single line disables the JWT library's cryptographic signature verification." publisher: Rapid7 - quote: "Attackers are now using the @rapid7 POC for CVE-2026-55040 against our SharePoint honeypots" publisher: "Defused, quoted by BleepingComputer" - quote: "Internet threat watchdog Shadowserver currently tracks over 8,500 Microsoft SharePoint servers exposed online." publisher: BleepingComputer - quote: While Microsoft has labeled this security flaw as an attractive target for attackers publisher: BleepingComputer - quote: Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network. publisher: CISA Known Exploited Vulnerabilities catalog - quote: The authentication feature could be bypassed as this vulnerability allows impersonation. publisher: Microsoft Security Response Center verification: multi-source sourcing_note: > Both zero-days confirmed exploited by Microsoft and added to CISA KEV on 2026-07-14; MSRC per-CVE pages are the id/CVSS authority; the exploited/zero-day status is carried by the same-day CISA KEV listing (recorded in each CVE's status) and BleepingComputer's Patch Tuesday report, with ZDI and Krebs corroborating the release. The release's third zero-day (a publicly-disclosed BitLocker recovery-mode bypass, physical-access only) is reported unexploited and is not action-worthy for this constituency; a separate Exchange Server cross-site-scripting/spoofing flaw (CVE-2026-55008, CVSS 9.6) carries an Unproven exploit-maturity rating and requires user interaction, so it is noted for awareness only and excluded from the CVE table. confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 1 watchlist_hit: false actions: - "Confirm every on-premises SharePoint farm is at or above the August 2026 build for its line, and every on-prem AD FS server carries the July 2026 cumulative update: CVE-2026-56155, CVE-2026-56164, CVE-2026-55040 and CVE-2026-58644 are all confirmed exploited and KEV-listed. For any farm that was internet-reachable while unpatched, run a compromise assessment for forged-token access rather than closing the ticket on the upgrade." - "Before rotating IIS machine keys on any SharePoint that was internet-reachable, hunt for and evict machine-key harvesters first — CISA warns that rotating keys ahead of eviction lets a resident implant re-harvest the new keys." - "On every internet-reachable on-premises SharePoint farm, search the server-side trace logs back to 2026-08-11 for the issuer-validation message that records an issuer being accepted because no registered token service matched the signing certificate — it fires on the decisive step of this bypass and is the one artefact that separates a forged token from a normal one." updates: - at: "2026-07-15T04:36:00Z" run_id: 2026-07-15T0409Z-intel type: update summary: > An update to the 2026-07-14 Patch Tuesday coverage: three further SharePoint fixes and a Dynamics fix in the same cycle carry pre-auth risk. CVE-2026-55040 (CVSS 9.1) is a SharePoint JWT authentication bypass from Rapid7's Pwn2Own Berlin chain — an unauthenticated attacker who knows a target's AD SID or UPN can act as that user or administrator; Rapid7 demonstrated the chain at Pwn2Own and is holding full technical details and the PoC under a 30-day disclosure embargo, and the chained RCE half will not be patched until August, so applying the July fix now is the only break in the chain. CVE-2026-55944 (CVSS 9.8) is an unauthenticated deserialization RCE in Dynamics NAV / Dynamics 365 Business Central (on-prem) that Microsoft rates "Exploitation More Likely." Two SharePoint deserialization RCEs (CVE-2026-50522, CVE-2026-58644, both CVSS 9.8) round out the set. None is confirmed exploited in the wild yet. fields: - actions - affected_products - cves - evidence - sources - tags - techniques - body merged_from: 2026-07-15/microsoft-july-patch-tuesday-sharepoint-dynamics-followup - at: "2026-07-17T04:35:00Z" run_id: 2026-07-17T0409Z-intel type: update summary: > CVE-2026-58644 (CVSS 9.8), one of the July 2026 SharePoint deserialization RCEs previously rated only "Exploitation More Likely," is now confirmed actively exploited: CISA added it to the KEV catalog on 2026-07-16 and lists it among four on-prem SharePoint CVEs (with CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) it is aware of being exploited to gain unauthorized access, establish RCE, steal IIS machine keys and deploy malware. The fix shipped in the June 2026 cumulative update, so any on-prem SharePoint estate patched only through May is exposed; SharePoint Online is not in scope. fields: - actions - cves - evidence - sources - techniques - body merged_from: 2026-07-17/cve-2026-58644-sharepoint-confirmed-exploited-kev - at: "2026-07-22T04:34:31Z" run_id: 2026-07-22T0409Z-intel type: update summary: > CVE-2026-50522 (CVSS 9.8), a pre-auth deserialization RCE in Microsoft SharePoint Server 2016/2019/ Subscription Edition patched in July 2026, escalated to active in-the-wild exploitation on 2026-07-21 after a public PoC appeared: watchTowr honeypots recorded successful compromises within hours, and attackers steal server machine keys to forge ASP.NET authentication tokens — access that persists after patching unless keys are rotated. NCSC-NL flagged it; any org that considered the July SharePoint cluster remediated after CVE-2026-58644 must re-check 50522 exposure. fields: - cves - evidence - regions - sources - tags - body merged_from: 2026-07-22/cve-2026-50522-sharepoint-machine-key-theft-exploited - at: "2026-08-12T05:20:00Z" run_id: 2026-08-12T0411Z-intel type: update summary: > The SharePoint chain covered here on 2026-07-15 and flagged in the W29 outlook as half-patched until August is now complete on both halves. Microsoft's August Patch Tuesday published CVE-2026-63520, a remote code execution flaw Rapid7 states is the second of a pair that chain into a critical unauthenticated remote code execution against a vulnerable SharePoint server, and Rapid7 released a detailed technical analysis and a proof-of-concept for the first link, CVE-2026-55040, the CVSS 9.1 weak-authentication bypass Microsoft patched on 14 July. Patches exist for SharePoint Server Subscription Edition, 2019 and 2016; Microsoft records neither flaw as exploited, and rates both "Exploitation More Likely". fields: - actions - cves - evidence - references - regions - sectors - sources - techniques - body merged_from: 2026-08-12/sharepoint-cve-2026-63520-55040-unauth-rce-chain-poc - at: "2026-08-13T04:55:00Z" run_id: 2026-08-13T0412Z-intel type: update summary: > CVE-2026-55040, the CVSS 9.1 pre-authentication SharePoint Server authentication bypass patched in July, was reported being attacked with Rapid7's own proof-of-concept against honeypots on 2026-08-12, roughly a day after that code was published; Microsoft still does not record the flaw as exploited and Shadowserver counts over 8,500 SharePoint servers reachable from the internet. Rapid7's technical analysis — which this pipeline flagged yesterday as published but not yet read — root-causes it to four independent validation failures in SharePoint's token-handling pipeline that together let an unauthenticated caller present an unsigned token and be accepted as any site user or administrator. The mechanics supply what the advisories could not: a server-side trace message that fires on the decisive validation failure, and an unauthenticated reconnaissance request that precedes forgery. fields: - actions - affected_products - cves - entities - evidence - sources - techniques - body merged_from: 2026-08-13/sharepoint-cve-2026-55040-jwt-forgery-exploited-root-cause - at: "2026-08-19T04:47:00Z" run_id: 2026-08-19T0410Z-intel type: update summary: > CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities catalog on 2026-08-18, and ENISA's EU Vulnerability Database mirrors that date. This pipeline covered the flaw on 2026-08-13 when the only exploitation evidence was Rapid7's proof-of-concept being replayed against honeypots, and carried it as proof-of-concept-public rather than exploited; that is what has changed. The flaw is a pre-authentication weak-authentication bypass in Microsoft SharePoint Server that allows impersonation, patched in July 2026 for Subscription Edition, 2019 and Enterprise Server 2016. Microsoft's record has not been revised since 14 July and still records exploitation as no. For this constituency the listing lands on ground that has already been breached twice — the federal IT provider BIT and canton Graubünden both disclosed on-premises SharePoint intrusions in early August. fields: - actions - cves - evidence - sectors - sources - techniques - body merged_from: 2026-08-19/cve-2026-55040-sharepoint-kev-exploitation-confirmed - at: "2026-09-06T13:50:00Z" run_id: 2026-09-06T1308Z-audit type: correction summary: > The EPSS recorded for CVE-2026-55040 was ENISA EUVD's percentage rendering (3.97) rather than the probability the field holds. EUVD publishes EPSS multiplied by one hundred, so the value is a probability of 0.0397. Corrected in the CVE record and in the sentence of the 19 August update that quoted the bare number. The action list, which had accumulated eight items across four updates with five of them restating the same SharePoint patch step at different build baselines, is replaced with the three tasks that are still do-now work. fields: [cves, body, actions] - at: "2026-09-29T23:09:36Z" run_id: 2026-09-29T2134Z-audit type: improvement internal: true summary: > CISA's SharePoint alert has been revised twice since it was quoted: its exploitation sentence now lists six CVEs (CVE-2026-50522 added 2026-07-22, CVE-2026-55040 added 2026-08-18, both already covered by this entry's later records), and its July update note abbreviates the KEV catalog's name. The two evidence quotations follow the alert's current text. The status of CVE-2026-50522 now records its KEV listing of 2026-07-22, which the alert and the later records already state. The 2026-07-17 analysis now gives the four-CVE statement as the alert read on 2026-07-16 rather than as a current quotation, and the Dutch NCSC-NL quotation is given as a marked English translation with the Dutch original alongside. A reference to a retired weekly outlook is removed from the 2026-08-12 analysis. fields: [evidence, cves, body] migrated_from: null --- Microsoft's July 2026 Patch Tuesday is its largest ever by CVE count and carries two zero-days Microsoft confirms were exploited before a fix existed, both added to CISA's Known Exploited Vulnerabilities catalog the same day ([BleepingComputer, 2026-07-14](https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/)). **CVE-2026-56155** (CVSS 7.8, CWE-1220) is a local elevation-of-privilege in Active Directory Federation Services: an attacker who already holds a low-privileged authorized session on the AD FS host escalates to administrator ([Microsoft MSRC, 2026-07-14](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56155)). It is a post-foothold escalation rather than an initial-access vector, and Microsoft's advisory credits its own DART incident-response team in the acknowledgements — meaning it surfaced during a live intrusion, so an exposed AD FS host should be treated as a candidate for compromise assessment, not merely patched ([Microsoft MSRC, 2026-07-14](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56155)). **CVE-2026-56164** (CVSS 5.3, CWE-306) is the more exposed of the two: a missing-authentication flaw in on-prem SharePoint Server that lets an unauthenticated attacker elevate privileges over the network with no user interaction ([Microsoft MSRC, 2026-07-14](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56164)). Microsoft's mitigation guidance — enable AMSI on the SharePoint/IIS worker processes with Request Body Scan set to Full — indicates the trigger is a crafted HTTP POST body, the same class of exposure as the CVE-2026-45659 SharePoint deserialization RCE reported on 2026-07-02, so operators who already tuned AMSI for that flaw have partial coverage. **Defender takeaway:** patch both now; for AD FS the low CVSS understates the risk because the bug was caught in real-world incident response — treat internet- or partner-reachable AD FS servers as potentially targeted and pair the patch with a hunt of local process activity on those hosts. **Triage:** the AD FS escalation manifests in host-local process-execution and privilege-transition telemetry on the AD FS server itself (a low-privileged service account acquiring administrator context), not in network logs — normal AD FS operation does not spawn privilege transitions from its service account, so that lineage is the discriminator; the SharePoint escalation surfaces in IIS/SharePoint worker-process telemetry as an unauthenticated request preceding an unexpected privilege context, which AMSI full-body scanning is positioned to catch. No IOCs or exploiting cluster have been published for either. ## Update — 2026-07-15T04:36:00Z The July Patch Tuesday entry covered the two KEV-listed exploited zero-days (AD FS CVE-2026-56155, SharePoint CVE-2026-56164). Four further high-severity fixes in the same cycle carry pre-auth risk and warrant separate attention. **CVE-2026-55040** (CVSS 9.1, weak authentication) is a SharePoint JWT token-validation bypass that Rapid7's Stephen Fewer built into a two-vulnerability chain for Pwn2Own Berlin 2026: a remote unauthenticated attacker who knows a target's Active Directory SID or User Principal Name can forge identity and operate as that SharePoint user or administrator ([Rapid7 Labs, 2026-07-14](https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed)). Rapid7 chained it to a still-undisclosed RCE that Microsoft will not patch until the August 2026 cycle — but "patching CVE-2026-55040 will successfully break this exploit chain," so the July update is the available defense today even with the RCE half outstanding ([Rapid7 Labs, 2026-07-14](https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed)). **CVE-2026-55944** (CVSS 9.8) is an unauthenticated deserialization RCE in **Microsoft Dynamics NAV / Dynamics 365 Business Central (on-premises)** — "deserialization of untrusted data ... allows an unauthorized attacker to execute code over a network," triggered by a crafted login request before any session exists (vector AV:N/AC:L/PR:N/UI:N), and rated "Exploitation More Likely" ([Microsoft MSRC, 2026-07-14](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55944)). It is easy to overlook against SharePoint or Exchange in a busy Patch Tuesday, yet on-prem Dynamics back-office instances are frequently exposed. Two more SharePoint deserialization RCEs — **CVE-2026-50522** and **CVE-2026-58644** (both CVSS 9.8, "Exploitation More Likely") — require Site-Owner-level access per Microsoft's FAQ; CVE-2026-50522 is fixed in the July cumulative update, while CVE-2026-58644's patch actually shipped in the June cumulative update and the CVE was only documented on 14 July after being omitted from June's release notes — so a SharePoint estate patched through June is already covered for 58644 ([Microsoft MSRC, 2026-07-14](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50522)). **Defender takeaway:** the JWT-bypass path is invisible to normal sign-in and Conditional-Access telemetry because no credential is presented — hunt SharePoint web-server access logs for requests bearing anomalous JWT bearer tokens referencing SIDs/UPNs that do not match the session's authenticated principal, and audit-log operations performed "as" a user with no corresponding interactive or API sign-in in the same window. For the deserialization RCEs, the durable signal is the classic .NET deserialization-to-RCE lineage — anomalous `w3wp.exe` (SharePoint app-pool) or the Dynamics service host spawning child processes following list/webpart operations or an inbound login request. **Triage:** legitimate SharePoint operations are tied to a preceding authenticated sign-in for the acting principal; an operation attributed to a user or administrator with no matching sign-in event, or a service-account process spawn outside normal batch/report windows, is the discriminator. ## Update — 2026-07-17T04:35:00Z The 2026-07-15 entry carried CVE-2026-58644 as a CVSS 9.8 SharePoint deserialization RCE rated only "Exploitation More Likely," with its patch noted as having shipped in the June 2026 cumulative update. CISA has now confirmed it is being exploited in the wild: its SharePoint alert, as updated on 2026-07-16, stated that CISA was aware of active exploitation of CVE-2026-32201, CVE-2026-45659, CVE-2026-56164 and CVE-2026-58644, enabling unauthorized access to on-premises SharePoint Server instances (the alert has since added CVE-2026-50522 and CVE-2026-55040), and CISA added CVE-2026-58644 to the KEV catalog the same day ([CISA, 2026-07-16](https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations)). The alert describes the cluster's post-exploitation as stealing IIS machine keys — the ASP.NET view-state signing/encryption keys — and using deserialization techniques to gain persistence and deploy malware, so the machine key, not the single CVE, is the durable foothold once any of the four is exploited. **Defender takeaway:** the operational shift is from "patch on cadence" to "assume-targeted if unpatched." CISA's own detection anchors for the cluster are the AMSI/MDAV signatures `Exploit:Script/SuspSignoutReqBody.A` (request-body scanning, Subscription Edition only), `Exploit:Script/ToolPaneAuthBypass.A`/`.C` (request-header scanning and RCE coverage, all three versions) and `Backdoor:MSIL/LeakFang.A!dha` (post-exploitation IIS-secret harvesting) — so verify AMSI integration is enabled in Full Mode for each SharePoint web application, review worker-process (`w3wp.exe`) telemetry for web-shell and machine-key access, and treat internet-facing SharePoint behind anything less than an authenticating Layer 7 reverse proxy as the priority exposure. **Triage:** legitimate SharePoint deserialization activity does not read `MachineKey` material or write web shells into layouts/`_vti_` paths; machine-key access or a worker-process file write in those paths, absent a corresponding administrative change, is the signal. ## Update — 2026-07-22T04:34:31Z The July 2026 SharePoint patch cluster carried CVE-2026-50522, a deserialization-of-untrusted-data RCE that all sources had assessed as not-yet-exploited (Microsoft flagged only an "increased likelihood"). That changed on 2026-07-21: NCSC-NL updated advisory NCSC-2026-0237 to report, per watchTowr, that public exploit code for CVE-2026-50522 was published and the flaw is now **actively exploited against on-premises SharePoint**, with attackers stealing machine keys for long-term access ([NCSC-NL, 2026-07-21](https://advisories.ncsc.nl/advisory?id=NCSC-2026-0237)). watchTowr detailed the chain (relayed via BleepingComputer): a malicious .NET `BinaryFormatter` payload is delivered as the cookie of a forged `SecurityContextToken` in a WS-Federation sign-in response posted to SharePoint's `/_trust/default.aspx` endpoint; a successfully processed payload executes code and lets the attacker exfiltrate the server's **machine keys**, which are then used to forge valid ASP.NET authentication tokens/ViewState — giving persistent, re-authenticatable access that survives patching unless the keys are rotated ([BleepingComputer, 2026-07-21](https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/)). A PowerShell PoC (attributed by BleepingComputer to researcher "Janggggg") went public on 2026-07-20, and watchTowr's Attacker Eye honeypots captured successful compromises within hours ([BleepingComputer, 2026-07-21](https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/)); Security Affairs corroborates that the public PoC triggered active exploitation ([Security Affairs, 2026-07-21](https://securityaffairs.com/195760/security/public-poc-triggers-active-exploitation-of-critical-sharepoint-rce-vulnerability-cve-2026-50522.html)). No authentication is required for the initial RCE. **Defender takeaway:** this is the second CVE in the July SharePoint cluster to reach confirmed exploitation (after CVE-2026-58644 on 2026-07-17), and it validates the machine-key-theft concern already raised for that cluster — an estate that treated the July cycle as fully remediated after the 58644 fix is still exposed to 50522 and to key forgery. The remediation is the one already published for this cluster: apply the July 2026 update, then evict any machine-key harvester before rotating IIS machine keys (rotating ahead of eviction lets a resident implant re-harvest the new keys). Detection concept, telemetry-class first: in web/application-server and IIS/SharePoint request logs, the anchor is anomalous `POST` bodies containing serialized .NET payloads to `/_trust/default.aspx`, and ULS log entries reflecting BinaryFormatter deserialization exceptions; on the identity side, watch for SharePoint-issued auth tokens/ViewState that validate against a machine key not present in the current IIS worker-process configuration — a signal the key was exfiltrated and is being reused externally. **Triage:** legitimate WS-Federation sign-in traffic to `/_trust/default.aspx` carries normal token structures; a request whose token cookie contains a serialized .NET object graph is the discriminator. ## Update — 2026-08-12T05:20:00Z The entry on July's SharePoint pre-auth JWT bypass covered CVE-2026-55040 as one half of a Pwn2Own chain whose second half was still unpatched — a SharePoint chain half-patched until August. Both halves are now disclosed and one of them has public exploit code. Microsoft's August Patch Tuesday published CVE-2026-63520, a remote code execution vulnerability in SharePoint Server, and Rapid7 — whose Senior Principal Security Researcher Stephen Fewer discovered it — states that "this vulnerability is the second in a pair of exploits which, when chained together, comprise a critical unauthenticated remote code execution vulnerability in a vulnerable SharePoint server" ([Rapid7, 2026-08-11](https://www.rapid7.com/blog/post/em-patch-tuesday-august-2026/)). The same post records the second half of the release: "Alongside today's coordinated disclosure of CVE-2026-63520, Rapid7 has now published a detailed technical analysis and proof-of-concept for CVE-2026-55040, the first vulnerability in the chain." The two records read very differently on their own, which is the point of reading them together. Microsoft classes CVE-2026-63520 as improper input validation (CWE-20), CVSS 8.1 with high attack complexity, severity Important, allowing an unauthorised attacker to execute code over a network ([MSRC, 2026-08-11](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63520)). CVE-2026-55040 is the more severe of the pair on its own terms: "Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network", CWE-1390, CVSS 9.1 with low attack complexity and no privileges or user interaction required, severity Critical ([MSRC, 2026-08-11](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040)). Microsoft records both as not exploited and not publicly disclosed before their patches, and rates both "Exploitation More Likely". Patches exist for SharePoint Server Subscription Edition, 2019 and 2016 ([Rapid7, 2026-08-11](https://www.rapid7.com/blog/post/em-patch-tuesday-august-2026/)). What moves this ahead of the ordinary patch cycle is not a score but the disclosure state. The authentication-bypass half now has published analysis and working proof-of-concept code, and the code-execution half it chains into was documented the same day — so the research cost of reconstructing an unauthenticated RCE against an unpatched on-premises farm has collapsed to reading two public write-ups. Nothing in either advisory reports exploitation yet; the exposure is the window between publication and patch coverage, on a product class whose internet-facing deployments are collaboration portals rather than obscure infrastructure. That window matters more than usual for this constituency. Two Swiss public-sector SharePoint compromises were disclosed in the last nine days — the Confederation's own IT provider on 4 August and the canton of Graubünden on 5 August, both on-premises estates and both attributed by the affected bodies to the SharePoint flaws disclosed in mid-July. Neither of those intrusions involves the CVEs here, and nothing in the cited sources connects them; the relevance is the estate, not the incident. An organisation that has just rebuilt or re-imaged SharePoint servers in response to the July wave is exactly the organisation whose new builds may predate both the July and August updates, and whose asset inventory for those hosts is least likely to be current. Detection concepts are constrained by what has been published: neither Microsoft record describes the vulnerable code path, and this entry does not have Rapid7's technical analysis in hand, so behavioural detail beyond the advisories would be invention. What the advisories do support is exposure work rather than detection work — enumerate on-premises SharePoint farms and their patch levels across Subscription Edition, 2019 and 2016, and treat internet-reachable ones as the priority, since both halves of the chain are network-reachable with no authentication and no user interaction. Where a farm's August update cannot be applied immediately, restricting the server's reachability to authenticated internal networks is the control that does not depend on knowing which request shape to look for. ## Update — 2026-08-13T04:55:00Z Yesterday's entry recorded that Rapid7 had published a technical analysis and proof-of-concept for CVE-2026-55040 and stated plainly that it did not have that analysis in hand, so no behavioural detail could be offered. Two things changed within a day. The proof-of-concept is being used in attacks, and the analysis — read in full for this entry — turns an exposure problem into a hunt. Threat-intelligence company Defused reported on 2026-08-12 that "Attackers are now using the @rapid7 POC for CVE-2026-55040 against our SharePoint honeypots", roughly a day after the code was published ([BleepingComputer, 2026-08-12](https://www.bleepingcomputer.com/news/microsoft/hackers-leverage-new-microsoft-sharepoint-exploit-in-attacks/)). That is one company observing its own sensors, not a vendor confirmation: the same report notes that "While Microsoft has labeled this security flaw as an attractive target for attackers", it has not yet flagged it as successfully exploited in the wild ([BleepingComputer, 2026-08-12](https://www.bleepingcomputer.com/news/microsoft/hackers-leverage-new-microsoft-sharepoint-exploit-in-attacks/)). Switzerland's NCSC added the exploitation-attempt claim to its own July Patch Tuesday advisory on 12 August, having added the analysis and proof-of-concept to the same advisory the day before ([NCSC-CH, 2026-08-12](https://security-hub.ncsc.admin.ch/#/posts/12764)). For scale, the same reporting cites Shadowserver, which "currently tracks over 8,500 Microsoft SharePoint servers exposed online", with the honest caveat that how many are honeypots or already patched is unknown ([BleepingComputer, 2026-08-12](https://www.bleepingcomputer.com/news/microsoft/hackers-leverage-new-microsoft-sharepoint-exploit-in-attacks/)). **How the bypass works, and why it matters that it is four bugs and not one.** Rapid7's analysis, based on decompilation of the identity module from a fully patched Subscription Edition build, states that "The root cause is a chain of four distinct weaknesses that, when combined, allow an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user" ([Rapid7, 2026-08-11](https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/)). SharePoint's server-to-server authentication uses a nested token: an outer token carrying user identity claims, and an inner "actor token" representing the calling application that is expected to be cryptographically signed. Each of the four failures removes one guarantee from that design. First, the token handler explicitly turns off the requirement for signed tokens when it builds its validation parameters — Rapid7's description is blunt: "This single line disables the JWT library's cryptographic signature verification", so the outer token is accepted with no signature at all. Second, the code resolves the inner actor token's signing key from a thumbprint value carried in that token's own header, searching all trusted certificates including SharePoint's own local security-token-service certificate, and assigns the resolved key without ever verifying a signature against it. Third, issuer validation then looks for a registered token service matching that certificate, does not find one — because the server's own signing certificate is not in the collection being searched — and treats the absence of a match as grounds to accept rather than reject. Fourth, the final signature step requires only that a signature string be non-empty; any arbitrary value satisfies it. The result is that the identity in the outer token's name claim, which the caller chooses, is resolved to a real account. ([Rapid7, 2026-08-11](https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/)) Two properties of that chain matter operationally more than the mechanics themselves. The certificate whose thumbprint the attacker needs is published by the server: Rapid7 records that it is retrievable from an unauthenticated metadata endpoint on the SharePoint site itself, so no prior access is required to obtain it. And picking a *useful* identity is a separate reconnaissance step — Rapid7 describes querying the target's domain controller over an anonymous SMB session to learn the domain identifier, then walking relative identifiers to enumerate candidate accounts and find one that is a site administrator, noting that a user principal name works too but is less reliable to guess. ([Rapid7, 2026-08-11](https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/)) **Detection, in telemetry terms.** The decisive weakness leaves a server-side record: Rapid7's decompilation shows the issuer-validation path emitting a trace message stating that the issuer was accepted *because no registered token service matches the signing certificate*, immediately before returning success ([Rapid7, 2026-08-11](https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/)). On a healthy farm that path should be rare; on an attacked one it fires on every forged token. That message in the SharePoint diagnostic trace logs is the highest-value single artefact available, and it is a server-side one, so it survives an attacker who never touches the endpoint. Alongside it, three sequences are worth building around: an unauthenticated request to the site's metadata endpoint from an external address, followed within a short window by bearer-token requests to the site's REST API from the same source; authenticated REST activity — reading files, minting a form digest, changing configuration — with no corresponding interactive sign-in or federation token issuance for that account in identity logs; and anonymous SMB sessions enumerating account identifiers from an address that also talks to the SharePoint front end. **Triage:** legitimate server-to-server integrations also present bearer tokens to the SharePoint REST API, which is why the token's presence is not the signal. The discriminators are the ones the mechanism forces: a token whose acceptance is accompanied by the unregistered-signing-certificate trace message, activity attributed to a highly privileged account with no matching sign-in event in the identity provider, and an external source address that fetched the unauthenticated metadata endpoint shortly beforehand. A normal integration is registered, so its issuer resolves against a registered token service and never takes the accepting-by-default branch. **Defender takeaway:** patching remains the fix and it has existed since 14 July, but a farm patched today was reachable and forgeable for four weeks, and public exploit code has now been in circulation for two of those days with attack traffic already observed. The exposure question and the compromise question have therefore separated. For this constituency the estate context is unchanged from yesterday and still sharp: the Confederation's own IT provider and the canton of Graubünden both disclosed on-premises SharePoint intrusions in the preceding nine days, from a different set of flaws — the relevance is that these are the organisations most likely to be rebuilding SharePoint hosts right now, from images that may predate the July update. Where the July update cannot be confirmed on a reachable farm, the controls that do not depend on knowing the request shape are the ones CISA published on 15 July for this product class: keep SharePoint off the public internet unless necessary, block external access to Central Administration, restrict farm and database communication to required systems, and put any necessarily-exposed server behind an application-layer proxy ([BleepingComputer, 2026-08-12](https://www.bleepingcomputer.com/news/microsoft/hackers-leverage-new-microsoft-sharepoint-exploit-in-attacks/)). ## Update — 2026-08-19T04:47:00Z The exploitation status flipped. CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities catalog on 2026-08-18, describing it as a weak-authentication flaw that "allows an unauthorized attacker to bypass a security feature over a network" ([CISA KEV catalog, 2026-08-18](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)), ENISA's EU Vulnerability Database carries the same date and an EPSS probability of 0.0397 (which EUVD renders as the percentage 3.97), mirroring that determination rather than independently confirming it ([ENISA EUVD, 2026-08-18](https://euvd.enisa.europa.eu/enisa/eu_vulnerability_database/EUVD-2026-44211)). The earlier entry carried this flaw as proof-of-concept-public on the strength of Rapid7's exploit being replayed against honeypots a day after publication — real exploitation attempts, but against sensors rather than estates. The federal catalogue now classes it as exploited outright, which is a stronger statement than honeypot telemetry even though it rests on one authority. Microsoft's own record has not moved. It still records exploitation as no, and its published explanation of the impact remains that "the authentication feature could be bypassed as this vulnerability allows impersonation" ([Microsoft Security Response Center, 2026-07-14](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040)) — the vendor rates the flaw Critical at CVSS 9.1 and does assess exploitation as more likely, which agrees with the catalogue's direction — what disagrees is the record's own exploited field, still set to no with no revision since 14 July. That is the second Microsoft CVE in this catalogue update whose exploited field contradicts the catalogue, and it is a reason not to let a vendor-scored feed be the only input to a SharePoint patch decision. (On the sibling IKE Extension flaw the vendor's exploitability assessment is the disagreeing field too; here only the exploited flag is.) The reason this matters here more than the score suggests is the estate. Switzerland's federal IT provider BIT confirmed a SharePoint Server intrusion affecting around 200 federal user and technical accounts, and canton Graubünden disclosed its own SharePoint server breach a day later — both already covered here, and neither publicly tied to this identifier by any source. What the exploitation listing changes is the standing of an unpatched, internet-reachable farm: the honest reading is no longer "a proof-of-concept exists" but "this is being used", and a farm that sat exposed between the July patch and now warrants a look at its authentication records rather than an upgrade ticket alone. Hunting concentrates on the impersonation outcome rather than the request that produced it, because a forged token is accepted by design once validation fails. In authentication and application telemetry, the signals are SharePoint access events whose asserted identity has no corresponding interactive sign-in from the same source within the session window, site-administrator-level operations from a client that never authenticated normally, and unauthenticated requests to token-handling endpoints immediately preceding privileged activity. **Triage:** federated and app-only access legitimately produce SharePoint operations with no interactive sign-in, so that pattern alone is normal in most tenants — the discriminators are whether the asserted principal is one that federation or a registered application is actually configured to assert, and whether the source address belongs to the estate's own service ranges. Patching is the remediation; there is no configuration workaround in the vendor's record. ## Correction — 2026-09-06T13:50:00Z The EPSS figure quoted for CVE-2026-55040 in the update of 19 August was ENISA's EU Vulnerability Database rendering, which expresses EPSS as a percentage rather than as the probability itself. EUVD's own API returns the value multiplied by one hundred, so the 3.97 recorded there is an exploitation probability of 0.0397, not 3.97 ([FIRST.org EPSS API, value as of 2026-08-18](https://api.first.org/data/v1/epss?cve=CVE-2026-55040&date=2026-08-18)). Nothing about the exploitation assessment changes: CISA's catalogue listing, not the EPSS figure, is what moved this flaw to exploited. The action list is also cut back. It had grown to eight items across four updates, five of them restating the same SharePoint patch step at four different build baselines, and two months on most of those baselines are superseded. What remains are the three tasks still worth starting now: bringing every on-premises SharePoint farm to the August 2026 build and every AD FS server to the July cumulative update, with a compromise assessment for any farm that was internet-reachable while unpatched; hunting and evicting machine-key harvesters before rotating IIS machine keys; and searching server-side trace logs back to 2026-08-11 for the issuer-validation message that distinguishes a forged token from a normal one.