The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal and private entities to patch SharePoint servers without delay. Three critical flaws, including two active zero‑days, must be remediated immediately to prevent remote exploitation.

Key Takeaways (मुख्य बिंदु)

  • CISA added three actively exploited SharePoint vulnerabilities to its KEV catalog and demanded rapid patching.
  • Critical CVEs – 2026‑56164, 2026‑55040, and 2026‑58644 – enable remote code execution and privilege escalation.
  • Organizations should isolate SharePoint servers, enforce custom logging, rotate IIS keys, and keep security tools up‑to‑date.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday issued a firm directive to harden Microsoft SharePoint deployments after a wave of newly disclosed zero‑day flaws. Aligning with Board of Director (BOD) 26‑04 guidance, CISA expects federal agencies to apply the required patches within three days.

Background and Recent Updates

The most recent exploit, CVE‑2026‑56164, is a privilege‑escalation bug that can be leveraged remotely without authentication. Microsoft addressed this issue in the July 2026 Patch Tuesday release. Simultaneously, CVE‑2026‑55040 and CVE‑2026‑58644 – both classified as critical severity – allow attackers to bypass SharePoint security controls and execute arbitrary code.

Core Vulnerabilities and Risks

These flaws affect all supported on‑premises SharePoint Server editions (Subscription Edition, 2019, and 2016). Once exploited, adversaries can steal IIS machine keys, employ deserialization techniques for persistence, and deploy malware across the network. CISA also highlighted CVE‑2026‑32201, a spoofing vulnerability patched in April after being used as a zero‑day, and CVE‑2026‑45659, a code‑execution bug fixed via an out‑of‑band update in May and later added to the KEV list.

Security Recommendations

Organizations are urged to:

  • Immediately install Microsoft’s latest patches for all listed CVEs.
  • Ensure that security products cover every SharePoint web application and conduct proactive intrusion hunting.
  • Rotate IIS machine keys regularly, enable tailored logging, and keep SharePoint servers off the public internet.
  • Restrict access to administrative interfaces and enforce least‑privilege principles.

Future Implications

Failure to adopt these measures could expose enterprises to data exfiltration, ransomware deployment, and broader supply‑chain disruptions. Zero‑day exploits often target high‑value entities such as government agencies and large corporations, amplifying national cyber‑risk. By spotlighting these flaws in the KEV catalog, CISA aims to curb large‑scale attacks and reinforce the United States’ cyber‑defense posture.