SharePoint 4-CVE Nation-State Chain: How CVE-2026-32201, CVE-2026-45659, CVE-2026-56164 & CVE-2026-58644 Are Used Together to Steal IIS Machine Keys

On July 14, 2026, CISA issued an unusual advisory: rather than adding a new vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, it published a dedicated SharePoint hardening guidance document warning that threat actors are chaining four separate SharePoint Server CVEs — CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644 — in coordinated campaigns against on-premises SharePoint deployments. The CISA advisory confirmed that attackers are stealing IIS machine keys and using deserialization techniques to achieve persistence that survives most remediation attempts.

Each individual CVE in this chain has been addressed separately in advisories and patch guidance. What CISA's July 14 bulletin made explicit — and what organisations running on-premises SharePoint need to understand — is that patching a single vulnerability in the chain is not sufficient. The campaign exploits multiple vulnerabilities in sequence, and adversaries have demonstrated the ability to pivot across the chain even when individual patches are applied out of order.

CVE-2026-32201: The Initial Access Vector

CVE-2026-32201 is the entry point of the chain. While Microsoft's full technical disclosure is limited, CISA's advisory identifies it as an authentication-related flaw in SharePoint Server that enables a network-accessible attacker to establish an initial foothold without full administrator privileges. This initial access is then used to trigger the deserialization vulnerability in CVE-2026-45659.

The significance of CVE-2026-32201 in this campaign is that it lowers the barrier to exploitation. While CVE-2026-45659 (CVSS 8.8) requires low privileges, CVE-2026-32201 enables threat actors who do not already hold a SharePoint account to create the conditions for exploitation. In environments with external SharePoint access — extranet portals, partner-facing sites, document-sharing platforms — this represents an unauthenticated entry path.

Affected versions follow the same pattern as the rest of the chain: SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. SharePoint Online (Microsoft 365) is not affected.

CVE-2026-45659: Deserialization RCE (CVSS 8.8)

CVE-2026-45659 is the core remote code execution component of the chain. With a CVSS score of 8.8, it results from deserialization of untrusted data in Microsoft Office SharePoint. An attacker with low-level SharePoint privileges — obtained via CVE-2026-32201 or through a compromised internal account — can trigger this deserialization to execute arbitrary code over the network.

The attack complexity is rated low, and no user interaction is required. In active exploitation, CISA and Microsoft observed threat actors using this vulnerability to execute PowerShell commands, drop web shells, and begin lateral movement within the SharePoint farm. The Storm-2603 threat group has been confirmed using this CVE as part of Warlock ransomware deployment campaigns.

CVE-2026-56164 and CVE-2026-58644: Privilege Escalation and Persistence

CVE-2026-56164 (CVSS 9.8) is an unauthenticated privilege escalation vulnerability — the authentication bypass component of the chain. In ToolShell-style campaigns, this CVE allows attackers who have already achieved initial code execution to elevate to SharePoint farm administrator level, granting them full control over the SharePoint application tier.

CVE-2026-58644 (CVSS 9.8) completes the privilege escalation path and has been confirmed as a zero-day in active exploitation. Together, CVE-2026-56164 and CVE-2026-58644 give attackers the administrative access required to perform the most damaging step in the campaign: IIS machine key extraction.

The IIS Machine Key Theft: Why This Is Worse Than a Standard RCE

Standard ransomware or espionage campaigns following a SharePoint compromise would typically deploy a web shell and use it for command-and-control. The nation-state actors behind this campaign have gone further, and this is what makes CISA's July 14 advisory notable.

IIS machine keys are the cryptographic secrets that ASP.NET uses to protect session state, view state, and authentication tokens. When an attacker obtains the machine keys, they can forge view state payloads — which IIS will accept as legitimate and deserialize. This means an attacker with stolen machine keys can re-exploit the deserialization pathway indefinitely, even after CVE-2026-45659 is patched, as long as the old machine keys remain in use.

In practical terms: if your SharePoint farm was compromised before patching, patching CVE-2026-45659 alone does not close the door. Attackers who extracted the machine keys before the patch can still trigger deserialization by sending forged view state to the patched server, because the server will deserialize anything signed with its own machine key.

This is the persistence mechanism CISA flagged explicitly, and it is the reason the hardening advisory included machine key rotation as a mandatory remediation step — not just patch application.

Remediation: The Full Sequence

Patch application is necessary but not sufficient. The complete remediation sequence is as follows.

First, apply all available SharePoint Server patches covering CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644. Microsoft has released patches for SharePoint Server Subscription Edition, 2019, and 2016. Apply these to every server in the SharePoint farm — web front-ends, application servers, and any servers hosting SharePoint services.

Second, rotate all IIS machine keys across every server in the farm. Machine keys are configured in web.config files at the application and site level. For SharePoint farms, this includes the SharePoint Central Administration site as well as all web applications. Use a cryptographically random new key for each machine key element (validationKey and decryptionKey). Ensure the keys are consistent across all front-end web servers in the farm (they must match for SharePoint distributed cache to function).

Third, review IIS logs, SharePoint ULS logs, and Windows event logs for evidence of exploitation before the patch date. Look for unusual PowerShell execution via the SharePoint worker process (w3wp.exe), unexpected .aspx file writes to the SharePoint hive or layouts directories, and anomalous network connections originating from the SharePoint application pool account.

Fourth, if evidence of compromise is found, treat the SharePoint farm as fully compromised. This means rotating all service account credentials used by SharePoint (farm account, application pool accounts, search account, user profile sync account), auditing Active Directory for signs of lateral movement, and reviewing connected systems that the SharePoint farm account has permissions to access.

Federal and Enterprise Timelines

Under CISA's Binding Operational Directive 22-01, US federal agencies faced a patch deadline of July 17 for CVE-2026-58644. Enterprise organisations without BOD obligations should treat this campaign as requiring immediate action. The combination of nation-state actors, confirmed active exploitation, and the machine key persistence mechanism makes this a P1 incident for any organisation running on-premises SharePoint with external access.

For Indian enterprises, CERT-In's 6-hour incident reporting obligation means that any evidence of exploitation in your environment must be reported to CERT-In within 6 hours of detection.

If you need help assessing whether your SharePoint farm has been compromised, or if you want to validate your remediation is complete before re-opening external access, contact [email protected] or learn about how Enforster AI continuously scans for post-compromise indicators in web application environments.

Patching a single CVE in a coordinated chain is table stakes — the IIS machine key rotation is the step that actually closes the persistence window attackers have already opened.