The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that threat actors are actively exploiting three (3) vulnerabilities in internet-exposed on-premises Microsoft SharePoint Server deployments to bypass authentication, achieve remote code execution (RCE), steal IIS machine keys, establish persistence, and deploy malware. The flaws (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) impact all supported self-hosted SharePoint Server versions, including SharePoint Server Subscription Edition. While Microsoft also patched two (2) additional SharePoint vulnerabilities (CVE-2026-55040 and CVE-2026-58644) that have not yet been observed in active attacks, CISA considers them likely future targets. Shadowserver currently tracks nearly 10,000 internet-exposed SharePoint servers, with more than 800 still unpatched against two (2) of the actively exploited flaws. CISA recommends organizations immediately apply Microsoft’s latest security updates, verify successful patch installation, enable AMSI integration and Microsoft Defender Antivirus detections, hunt for indicators of compromise before rotating IIS machine keys, implement enhanced logging, and minimize internet exposure by restricting administrative access or placing SharePoint servers behind Layer 7 reverse proxies. The three (3) actively exploited vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog, mandating federal agencies to remediate CVE-2026-56164 by July 17, 2026. Since November 2021, CISA has identified eleven (11) actively exploited SharePoint vulnerabilities, seven of which have also been leveraged in ransomware attacks.