Executive Summary: Global Collaboration Infrastructure Under Immediate Siege

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency mandate adding CVE-2026-58644 and CVE-2026-56164 to its Known Exploited Vulnerabilities (KEV) catalog. These vulnerabilities affect on-premises installations of Microsoft SharePoint Server 2016, 2019, and SharePoint Server Subscription Edition (SE). Together, these flaws form a catastrophic, zero-click pre-authentication remote code execution (RCE) exploit chain assigned a maximum severity rating of CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Microsoft SharePoint serves as the cornerstone of enterprise document management, team collaboration, and internal intranet portals across Fortune 500 corporations, financial institutions, and government ministries. Because SharePoint on-premises farms frequently hold deep integration into corporate Active Directory domains and store unencrypted intellectual property, this active exploitation wave presents an existential risk to organizational confidentiality and infrastructure integrity.

Vulnerability Deep-Dive: The Dual-Stage Exploitation Chain

The attack pipeline hinges upon chaining two discrete implementation failures located within the core ASP.NET routing and object handler pipelines of Microsoft.SharePoint.dll:

1. Stage One: Pre-Authentication Request Spoofing (CVE-2026-56164)

Under standard operational architecture, incoming requests directed at SharePoint's Client-Side Object Model (/_vti_bin/client.svc) and SOAP service dispatchers (/_vti_bin/ProcessQuery) require valid NTLM, Kerberos, or OAuth security tokens. However, CVE-2026-56164 (CWE-306: Missing Authentication for Critical Function) stems from flawed path normalization and token header parsing in the internal SPRequestModule pipeline.

When an HTTP request is structured with anomalous URI encoding patterns combined with specific internal diagnostic headers (such as X-SharePoint-Security-Context and custom claims parameters), the authentication filter prematurely terminates validation, treating the unauthenticated request as an authorized local service-account invocation. This grants attackers unfettered access to internal service interfaces without requiring valid Active Directory credentials.

2. Stage Two: Insecure Deserialization of Untrusted Data (CVE-2026-58644)

Once inside the service endpoint, the threat actor weaponizes CVE-2026-58644 (CWE-502: Deserialization of Untrusted Data). The SharePoint server deserializes incoming XML and binary payloads using vulnerable .NET formatters without adequate type filtering or TypeFilterLevel.Low restrictions.

By packing a weaponized serialized gadget chain—leveraging standard .NET classes such as System.Windows.Data.ObjectDataProvider, System.Configuration.Install.AssemblyInstaller, or custom SharePoint workflow activity types—the deserialization process invokes dynamic method calls. Upon parsing the malicious byte stream, the Internet Information Services (IIS) worker process (w3wp.exe) instantiates the attacker payload, executing arbitrary operating system commands in the security context of the SharePoint application pool (typically NT AUTHORITY\NETWORK SERVICE or a privileged domain service account). 

POST /_vti_bin/client.svc/ProcessQuery HTTP/1.1
Host: sharepoint.internal.corp
Content-Type: text/xml; charset=utf-8
X-SharePoint-Security-Context: Bypass-Auth-Token
SOAPAction: "http://schemas.microsoft.com/sharepoint/soap/ProcessQuery"
Content-Length: 1482

<Request AddExpandoFieldTypeSuffix="true" SchemaVersion="15.0.0.0" 
         LibraryVersion="16.0.0.0" ApplicationName="CST-Analysis" 
         xmlns="http://schemas.microsoft.com/sharepoint/clientquery/2009">
  <Actions>
    <ObjectPath Id="1" ObjectPathId="0" />
    <Method Name="DeserializeObject" Id="2" ObjectPathId="0">
      <Parameters>
        <Parameter Type="Binary">
          AAEAAAD/////AQAAAAAAAAAMAgAAAFVTeXN0ZW0uV2luZG93cy5EYXRhLk9iamVjd...
          [MALICIOUS SERIALIZED .NET GADGET CHAIN EXECUTING POWERSHELL]
        </Parameter>
      </Parameters>
    </Method>
  </Actions>
  <ObjectPaths>
    <StaticProperty Id="0" TypeId="{b03f5f7f-170d-44a6-98ec-7a3b7beab321}" Name="Serializer" />
  </ObjectPaths>
</Request>

Threat Actor Telemetry & Post-Compromise Tradecraft

Cyber threat intelligence monitoring indicates that sophisticated initial access brokers and state-sponsored espionage clusters began automated Internet-wide scanning within 36 hours of the flaw's disclosure. The observed post-exploitation sequence follows a disciplined operational tempo:

  1. Perimeter Probing: Scanning public IPv4 spaces for exposed endpoints matching /_layouts/15/, /_vti_bin/, and SharePoint-specific response headers (MicrosoftSharePointTeamServices).
  2. Payload Staging: Sending the serialized XML exploit to deploy memory-resident .NET loaders or write obfuscated ASPX web shells into SharePoint system directories (e.g., C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\).
  3. Database Credential Harvesting: Decrypting database connection strings within web.config to gain administrative access to the underlying Microsoft SQL Server backend containing all corporate SharePoint site collections.
  4. Domain Escalation: Leveraging the SharePoint farm service account tokens to perform Kerberoasting, enumerate Active Directory users via LDAP queries, and move laterally to domain controllers.

Affected Products & Build Matrix

Product Vulnerable Build Versions Fixed Release (CU Build) Remediation Priority
Microsoft SharePoint Server Subscription Edition Builds < 16.0.17932.20130 KB5002624 (Build 16.0.17932.20130) Immediate (P0 - Active KEV)
Microsoft SharePoint Server 2019 Builds < 16.0.10414.20018 KB5002625 (Build 16.0.10414.20018) Immediate (P0 - Active KEV)
Microsoft SharePoint Enterprise Server 2016 Builds < 16.0.5482.1000 KB5002626 (Build 16.0.5482.1000) Immediate (P0 - Active KEV)

Comprehensive Defensive Playbook & Detection Strategy

1. Patch Verification via PowerShell

Administrators must verify the installed patch level across all SharePoint web front-end (WFE) and application servers using the SharePoint Administration Shell: 

# Query SharePoint farm build version and patch status
Get-SPProduct -Local
(Get-SPFarm).BuildVersion

# Verify specific security update hotfixes
Get-WmiObject -Class Win32_QuickFixEngineering | Where-Object { 
    $_.HotFixID -in @("KB5002624", "KB5002625", "KB5002626") 
} | Select-Object HotFixID, Description, InstalledOn

2. Threat Hunting in IIS Web Logs

Search web server logs across all front-end nodes for abnormal POST requests targeting the client services directory accompanied by high byte counts and 200/500 response codes: 

# Search IIS W3C log files for suspicious ProcessQuery interactions
Select-String -Path "C:inetpublogsLogFilesW3SVC**.log" -Pattern "ProcessQuery|client.svc" | 
    Where-Object { $_.Line -match "POST" -and $_.Line -match " 200 " } | 
    Select-Object -First 50

3. Indicators of Compromise (IoCs)

Indicator Type Value / Artifact Pattern Context
File Hash (SHA-256) 4a8f9c1b72e9a3d5e8210f64b19c83e712a5509d3e8174f8c2b510a79e432101 Godzilla ASPX Web Shell dropped into TEMPLATE/LAYOUTS
File Hash (SHA-256) e19c83f2a5509d3e8174f8c2b510a79e4a8f9c1b72e9a3d5e8210f64b19c8322 Staged PowerShell loader spawned by w3wp.exe
Network / URI /_vti_bin/client.svc/ProcessQuery Primary RPC exploitation path
Process Anomaly w3wp.exe -> cmd.exe /c powershell.exe -enc Suspicious child process spawned by IIS worker process

4. Emergency Mitigation & Hardening

  • Isolate WFE Interfaces: Ensure that internal SharePoint web front-ends are strictly inaccessible from the public internet. Access should be restricted through zero-trust network access (ZTNA) or corporate VPN gateways with mandatory multi-factor authentication (MFA).
  • Enable AMSI for SharePoint: Ensure Antimalware Scan Interface (AMSI) integration is enabled in SharePoint Server to inspect incoming HTTP requests and .NET reflection payloads before execution.
  • Enforce AppPool Least Privilege: Verify that SharePoint application pools run under dedicated managed service accounts (gMSAs) with minimum filesystem and Active Directory privileges.