Threat Intelligence Brief
Curated summary with source attribution
Source: resecurity.com
Threat Risk: High
Victim: Organizations using on-premises Microsoft SharePoint Server
Incident: Active exploitation of multiple critical SharePoint vulnerabilities including CVE-2026-45659 and CVE-2026-56164.
Impact: Full system compromise leading to remote code execution and total domain takeover.
Attacker: Unidentified threat actors
Analysis: Attackers are chaining authentication bypasses and deserialization flaws to achieve remote code execution on on-premises SharePoint servers. By deploying web shells and stealing IIS machine keys, threat actors can escalate privileges and move laterally across the network. The inclusion of these flaws in CISA’s KEV catalog confirms a high level of active exploitation.
Recommendations: Immediately apply security updates for SharePoint Server 2016, 2019, and Subscription Edition.; Hunt for unauthorized web shells, specifically spinstall0.aspx, within SharePoint web directories.; Implement strict network segmentation to isolate SharePoint servers from sensitive domain controllers.
Source: Resecurity
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source