• CVE-2026-32201 Authentication bypass / spoofing. Enables access to protected layout endpoints and view pages without proper authentication. Added to CISA KEV April 14, 2026. The entry point.
• CVE-2026-45659 Deserialization of untrusted data (CVSS 8.8). Allows authenticated attackers with minimum Site Member permissions to execute arbitrary code remotely. No admin privileges required. Microsoft initially rated exploitation "less likely." CISA added to KEV July 1 after confirming active exploitation. The RCE.
• CVE-2026-56164 Missing authorization bypass (EoP). Reported by Google incident responders. Remotely exploitable, low complexity. Added to CISA KEV July 14, 2026 (yesterday). The persistence enabler.

The chain works like this: CVE-2026-32201 bypasses authentication to reach protected endpoints. CVE-2026-45659 triggers a .NET deserialization flaw inside the SharePoint worker process (w3wp.exe) to achieve RCE. CVE-2026-56164 escalates privileges to access IIS configuration and steal machine keys. With the machine keys, the attacker forges ASP.NET ViewState authentication cookies and maintains persistent access to the entire farm without needing credentials, C2, or malware. The LeakFang backdoor (Backdoor:MSIL/LeakFang.A!dha) handles post-exploitation credential and key harvesting.

Standard advice says "don't expose SharePoint to the internet." Air-gapped environments already meet that requirement. But this exploit chain is fully functional inside an isolated network. The RCE executes locally. The machine key theft is local. The forged cookies authenticate locally. The LeakFang backdoor doesn't need to beacon out. In an air-gapped environment, the attack chain operates entirely within the enclave.

An external attacker cannot directly exploit an air-gapped SharePoint server. But the payload only needs to reach the server through any vector that introduces content:

Contaminated removable media. The exploit payload or weaponized documents introduced via USB drives, transient laptops, or engineering stations. The same initial access vector as Stuxnet, Agent.BTZ, and every other air-gap-crossing attack.

Cross-domain transfers. If a data diode or manual sneakernet process moves files (templates, documentation, user data) from a lower-classification network to the air-gapped environment, the vulnerabilities can be triggered when SharePoint processes those files. The transfer mechanism is trusted. The content is not.

Insider threat. An individual with physical access could intentionally or accidentally introduce the exploit scripts. A compromised personal device used to prepare content for the air-gapped environment is sufficient.

Supply chain via approved patches. Exploit payloads embedded within approved software updates or patches brought over the high side. If the patch delivery mechanism is not integrity-verified end-to-end, it becomes a delivery channel.

Execution. When a user or automated process triggers the vulnerability (interacting with a weaponized SharePoint component or page), the RCE executes locally inside w3wp.exe. The deserialization flaw spawns shell processes (cmd.exe, powershell.exe, csc.exe) under the SharePoint application pool identity.

Machine key theft. The attacker's primary post-exploitation objective. With the IIS machine keys, they forge authentication cookies that bypass SharePoint's internal auth completely. In an air-gapped network, this is catastrophic: the attacker can move laterally across the entire SharePoint farm, access every document library, and establish persistence without any external communication.

Persistence without C2. The LeakFang backdoor doesn't need to beacon to the internet. Inside an air-gapped enclave, it listens locally or waits for specific triggers, collecting data until the attacker returns via removable media or a compromised workstation to harvest what the backdoor accumulated.

Data collection. SharePoint is typically the crown jewel of internal documentation: SOPs, operational plans, personnel rosters, mission-critical data. The attacker stages collected data locally on the SharePoint server until they can exfiltrate via a physical vector. The exfiltration timeline in air-gapped environments is measured in weeks, not hours, but the collection can be comprehensive.

1. 1. Hunt for anomalous w3wp.exe child processes The deserialization RCE spawns shell processes from the SharePoint worker process. Search Sysmon EID 1 or Security EID 4688 (with command line auditing) for w3wp.exe spawning: cmd.exe, powershell.exe, csc.exe (C# compiler, used for on-the-fly web shell compilation), wsmprovhost.exe, whoami.exe, net.exe, arp.exe, or any other reconnaissance tool. Sysmon EID 1: parent_process_name="w3wp.exe" AND (process_name="cmd.exe" OR "powershell.exe" OR "csc.exe" OR "whoami.exe")
2. 2. Scan IIS logs for deserialization payload markers Check IIS logs (typically %SystemDrive%\inetpub\logs\LogFiles) for POST requests to layout endpoints (/_layouts/15/...) carrying serialized payloads. Signature markers in the request body: AAEAAAD///// (standard .NET BinaryFormatter header) and /wE (ASP.NET ViewState/LosFormatter header). Also look for HTTP 500 spikes (failed exploitation attempts) and unexpected HTTP 200 responses to administrative endpoints from unauthorized internal IPs. IIS logs: POST to /_layouts/15/* with base64 payload markers · HTTP 500 spike analysis
3. 3. Hunt for machine key harvesting Monitor for any process (other than IIS/SharePoint system accounts) reading: web.config files inside SharePoint virtual directories (C:\inetpub\wwwroot\wss\VirtualDirectories\) or applicationHost.config (C:\Windows\System32\inetsrv\config\). Enable Windows object access auditing on these paths. Any non-standard user reading web.config is a high-confidence indicator of machine key theft. Security EID 4663 (Object Access) on web.config · Sysmon EID 11 on config directories
4. 4. Scan for web shells in SharePoint directories Search web server directories for newly created or modified .aspx, .ashx, or .asmx files. PowerShell: Get-ChildItem -Path "C:\inetpub\wwwroot\wss\VirtualDirectories\" -Recurse -Include *.aspx,*.ashx,*.asmx | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) }. Any file not present in the SharePoint installation baseline is suspicious. The csc.exe child process (C# compiler) from w3wp.exe often indicates an attacker compiling a web shell on the fly. HOST: Persistence · FIM on SharePoint web directories · Sysmon EID 11
5. 5. Check local AV for specific detection signatures Even in air-gapped environments with manually updated definitions, check Windows Defender event logs (Microsoft-Windows-Windows Defender/Operational, EID 1116/1117) for: Exploit:Script/SuspSignoutReqBody.A (request body exploitation), Exploit:Script/ToolPaneAuthBypass.A and .C (bypass and RCE coverage), and Backdoor:MSIL/LeakFang.A!dha (post-exploitation key harvester). If definitions are current, these signatures detect the known exploitation toolkit. Defender Operational log EID 1116/1117 · AMSI integration verification
6. 6. Review SharePoint ULS logs for deserialization traces ULS logs (C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\LOGS\) contain deep application-level execution traces. Filter for "Unexpected," "High," or "Critical" severity. Search for exceptions related to deserialization, type resolution failures, or ViewState validation failures. Failed exploitation attempts write verbose deserialization tracebacks. ULS logs: severity High/Critical · deserialization exception traces
7. 7. Check for ViewState anomalies (forged cookie detection) If machine keys were stolen, the attacker forges ViewState cookies. Look for: SharePoint authentication events from sessions that don't have corresponding login events (the forged cookie bypasses the login flow), sessions accessing administrative functions from non-admin accounts, and bulk document library access patterns that don't match any user's normal behavior. SharePoint audit logs · IIS logs: session correlation · Insider Threat baseline methods
8. 8. Verify AMSI is in Full Mode on all SharePoint web apps AMSI in Full Mode forces scanning of the HTTP Request Body, which is where the deserialization payloads live. If AMSI is in Default Mode, it scans a more limited set of SharePoint events and may miss the exploitation payload. Verify: SharePoint Central Administration, Manage Web Applications, select each web app, check AMSI configuration. SharePoint Central Admin: AMSI configuration per web app
9. 9. Rotate IIS machine keys AFTER hunting (not before) This order matters. If you rotate keys before hunting, you destroy the evidence of whether the current keys were compromised AND you might be rotating keys on a server that still has a key harvester installed (LeakFang), which means the attacker immediately gets the new keys too. Hunt first. Remove any web shells, backdoors, and harvester tools. Verify the server is clean. Then rotate keys to invalidate any previously stolen copies. CISA: "Before rotating IIS machine keys, hunt for and remediate any intrusion artifacts"
10. 10. Validate patch deployment across the entire farm SharePoint farms span multiple application and web-front-end servers. Installing the patch via Windows Update does not guarantee every component is serviced. The SharePoint Products Configuration Wizard (or PowerShell equivalent) must run on each server to complete the update. An unpatched WFE in a patched farm is still vulnerable. Verify the installed build number on every server against the fixed build. SharePoint: Get-SPProduct · Config wizard on each WFE

1. Strict AMSI enforcement. Enable AMSI in Full Mode for Request Body Scanning on every web application. Even without internet-updated definitions, locally staged MDAV signatures detect the known exploitation signatures. Include AMSI verification in your regular secure baseline audits.

2. Proactive key rotation (after hunting). Before applying patches via your high-side configuration management, hunt the SharePoint/IIS servers for unauthorized artifacts, web shells, and ViewState anomalies. Once confirmed clean, rotate the IIS machine keys to invalidate any potentially compromised copies that may have been harvested silently. Document the rotation in your change management.

3. Tailored internal telemetry. Configure your local SIEM or log aggregators (Elastic/Kibana, Security Onion, Malcolm) to ingest and alert on: w3wp.exe child process creation, web.config access by non-system accounts, new files in SharePoint virtual directories, ULS log critical events, and Defender signature detections. These are the minimum detection rules for this exploit chain.

4. File integrity monitoring on web directories. Deploy AIDE, Tripwire, osquery FIM, or a PowerShell scheduled task that monitors C:\inetpub\wwwroot\wss\VirtualDirectories\ for any new or modified .aspx/.ashx/.asmx files. In a stable SharePoint environment, these directories should not change between patch cycles.

5. Restrict cross-domain file transfer content types. If files transit from lower-classification networks to the air-gapped SharePoint via sneakernet or data diode, implement content inspection on the transfer: strip active content, scan with current YARA rules for deserialization payloads, and limit allowed file types to known-safe formats for the business process.

Since November 2021, CISA has flagged 11 Microsoft SharePoint vulnerabilities with confirmed exploitation. Seven of those 11 were exploited in ransomware attacks. This chain is the most sophisticated SharePoint exploitation campaign to date: three CVEs chained for auth bypass, RCE, and persistence. Microsoft's July 2026 Patch Tuesday addressed 570+ vulnerabilities (the company attributes the surge to AI-assisted security research), including two additional SharePoint flaws not yet exploited but flagged as high-risk (CVE-2026-55040 and CVE-2026-58644). On-premises SharePoint remains a persistent soft target due to slower patch adoption compared to cloud-hosted alternatives.

Air-Gapped OT / ICS (air-gap crossing vectors and detection in isolated environments)
Hybrid AD Enterprise (on-prem SharePoint in hybrid AD environments)
Insider Threat (forged ViewState access patterns resemble insider baseline deviation)
Supply Chain Indicator (contaminated patches as a delivery vector)
EternalBlue (precedent: a single exploit chain that changed the security posture of an entire platform)