SharePoint On-Prem Has Six KEV Entries This Year, Four Since July 1. The Fix Isn't 'Patch.'
- Patrick Duggan
- 2 hours ago
- 3 min read
If you run on-premises SharePoint and you are patching CVE by CVE, stop and look at the shape instead, because the shape is the whole story. In 2026 alone, CISA has added six SharePoint Server vulnerabilities to the Known Exploited Vulnerabilities catalog — CVE-2026-20963, CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522 — and four of those landed since July 1. On July 14, CISA stopped chasing individual bugs and published a general SharePoint hardening advisory. That is the tell: when a defender agency writes "harden the product" instead of "patch this CVE," they are telling you the individual flaw is not the problem anymore. The surface is.
This is the same movie that ran in 2025 with the ToolShell chain — CVE-2025-49704, CVE-2025-49706, and the patch-bypass CVE-2025-53770 that reopened it after everyone thought they were done. On-premises SharePoint is a .NET deserialization engine exposed to the network, and that design makes it a permanent target. The CVE numbers are interchangeable. A new one will land. Treating each as a one-off patch is how you stay behind forever.
The detail that makes "just patch" wrong
Here is the part that should change how you respond, and it is why the most recent one — CVE-2026-50522 — matters more than its severity score. Attackers exploiting it are stealing the server's IIS machine keys. Those keys are what SharePoint uses to sign and validate the ViewState and authentication tokens. Once an attacker has them, they can forge valid tokens whenever they want — which means they keep their access after you patch. The patch closes the door they came through; it does not change the locks they already copied.
So if your on-prem SharePoint was internet-reachable during any of the July exposure windows, patching is step one of several, not the finish line. You have to assume the keys walked.
The playbook — in the order that matters
Get it off the public internet, first. On-premises SharePoint is an internal collaboration server. There is almost never a good reason for the farm to be directly reachable from the open internet. Put it behind a VPN or a reverse proxy with real authentication. This single move neutralizes the entire unauthenticated-RCE class the KEV list keeps filling with — patched or not.
Patch to current across the whole cluster. All six 2026 CVEs, on every server in the farm. Confirm the running build, do not trust the deployment manifest.
Rotate the machine keys after you patch. This is the step nearly everyone skips, and it is the one that actually evicts an attacker who exploited CVE-2026-50522. New ASP.NET machine keys invalidate every forged token minted from the stolen ones. Patch without rotating and a determined intruder walks right back in through the front door with a token you are still trusting.
Turn on AMSI in full mode and keep antivirus live on the farm. Microsoft's SharePoint AMSI integration catches a lot of the post-exploitation web-shell drops that these chains end in. Full mode, not the default.
Hunt the LAYOUTS directory and the worker process. The end state of these attacks is a web shell. Look in the SharePoint LAYOUTS path for files that do not belong, and alert on the IIS worker process (w3wp.exe) spawning cmd.exe or powershell.exe — a SharePoint app pool has no business launching a shell. Check for the machine-key theft specifically if you were exposed.
Assume breach if you were exposed in the window. Four KEV entries in three weeks means the odds an internet-facing farm was probed are high. Hunt like it already happened, because for a lot of organizations it did.
The point
Microsoft will ship a seventh SharePoint deserialization CVE. The catalog says so; the last five years say so. You cannot patch your way out of an architecture whose whole job is to deserialize untrusted input over the network — you can only take that architecture off the network and rotate the secrets it hands out. Wall it off, patch it, rotate the keys, and hunt the farm. The specific CVE is noise. The standing wound is the product sitting on a public IP.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.