{"id":243527,"date":"2026-07-15T11:46:00","date_gmt":"2026-07-15T15:46:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/07\/15\/cisa-warns-that-multiple-vulnerabilities-in-sharepoint-are-under-exploitation\/"},"modified":"2026-07-15T14:10:09","modified_gmt":"2026-07-15T18:10:09","slug":"cisa-warns-that-multiple-vulnerabilities-in-sharepoint-are-under-exploitation","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/07\/15\/cisa-warns-that-multiple-vulnerabilities-in-sharepoint-are-under-exploitation\/","title":{"rendered":"CISA warns that multiple vulnerabilities in SharePoint are under exploitation"},"content":{"rendered":"

CISA warns that multiple vulnerabilities in SharePoint are under exploitation<\/a><\/p>\n

https:\/\/www.cybersecuritydive.com\/news\/cisa-multiple-vulnerabilities-sharepoint-exploitation\/825306\/<\/a><\/p>\n

Publish Date: 2026-07-15 11:46:00<\/a><\/p>\n

Source Domain: www.cybersecuritydive.com<\/a><\/p>\n

Author: <\/a><\/p>\n

Using an unordered list, summarize the following article with between 4 and 8 key points. <\/p>\n

The Cybersecurity and Infrastructure Security Agency warned Tuesday that three vulnerabilities in on-premises versions of Microsoft SharePoint Server are being targeted for exploitation.\u00a0
\nHackers are taking advantage of the flaws to steal internet information service machine keys. They gain persistent unauthorized access through deserialization techniques before releasing malware.\u00a0
\nAn improper input validation vulnerability, tracked as CVE-2026-32201, was originally disclosed in April. It allows an attacker to perform spoofing over a network.\u00a0
\nA remote code execution vulnerability, tracked as CVE-2026-45659, involves the deserialization of untrusted data. The flaw has a severity score of 8.8.\u00a0
\nThe third vulnerability, tracked as CVE-2026-56164, was disclosed on Tuesday. It allows an attacker to elevate privileges over a network.\u00a0<\/p>\n

Researchers at Rapid7 on Tuesday warned that a newly disclosed authentication bypass vulnerability, tracked as CVE-2026-55040, could enable remote code execution if chained together with a second flaw.\u00a0
\nRapid7 warned that a patch would not be issued until Microsoft\u2019s August security update cycle.\u00a0
\nWidespread risk
\nBecause SharePoint is a widely used document and collaboration platform, the exploitation activity is being closely watched by security teams across government and other sectors.\u00a0
\n\u201cCIS is tracking the vulnerabilities and have issued an advisory to members providing an overview, a list of impacted systems and recommendations,\u201d TJ Sayers, senior director of threat intelligence at the Center for Internet Security, told Cybersecurity Dive. \u201cWe see threat actors beginning exploitation of disclosed vulnerabilities, including ones deduced from vendor patch notes, within 24 to 72 hours of release.
\nCISA urged security teams to make sure Microsoft\u2019s Antimalware Scan Interface is enabled for each SharePoint web application. Microsoft has provided guidance on how to integrate AMSI with SharePoint.\u00a0
\nSecurity teams should rotate internet information services machine keys, but also check for any intrusion artifacts, including machine key harvesters, according to CISA.\u00a0
\nUsers should avoid exposing SharePoint directly to the internet and also block external access to SharePoint Central Administration, CISA said. CISA provided a link to a SharePoint hardening guide from Microsoft.<\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

CISA warns that multiple vulnerabilities in SharePoint are under exploitation https:\/\/www.cybersecuritydive.com\/news\/cisa-multiple-vulnerabilities-sharepoint-exploitation\/825306\/ Publish Date: 2026-07-15 11:46:00…<\/p>\n","protected":false},"author":1,"featured_media":243528,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/imgproxy.divecdn.com\/TdkWLzuvSB73h9Jv5F_OjkCQ5UlMG_5OYasDVUHZY_A\/g:ce\/rs:fit:770:435\/Z3M6Ly9kaXZlc2l0ZS1zdG9yYWdlL2RpdmVpbWFnZS9HZXR0eUltYWdlcy0xNDIxMDMwODAzLmpwZw==.webp","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,32,27],"class_list":["post-243527","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-malware","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/243527"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=243527"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/243527\/revisions"}],"predecessor-version":[{"id":243529,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/243527\/revisions\/243529"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/243528"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=243527"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=243527"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=243527"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}