SharePoint: Four July-August 2026 Flaws Now Exploited

What to do

1. Check each farm's build with (Get-SPFarm).BuildVersion and compare it with the August 2026 builds.
2. Install every August 2026 SharePoint package Microsoft lists for your version, then run PSConfig on each server.
3. Rotate ASP.NET machine keys (Update-SPMachineKey) and run iisreset after patching.
4. Remove direct internet exposure, or put the farm behind an authenticating Layer 7 reverse proxy.
5. Enable AMSI integration for every SharePoint web application.
6. Plan the move off SharePoint 2016 and 2019, which are past extended support.

How to check if you are affected or compromised

• Review Defender/AMSI alerts for Exploit:Script/SuspSignoutReqBody.A and Exploit:Script/ToolPaneAuthBypass.A.
• Search IIS logs for repeated /_layouts/ segments with AddGallery.aspx or designgallery.aspx, the query job=all&DisplayMode=Edit, and form fields MSOTlPn_Uri or MSOTlPn_DWP.
• Look for /_layouts/15/sphealth.aspx and for wt3k3sij.dll or an SdLoader type in memory or on disk.
• Check ULS and IIS logs for unusual bearer-token logins and admin activity from unfamiliar addresses since August 11.

What happened#

Three on-premises SharePoint bugs fixed in Microsoft's July 14, 2026 updates, and a fourth fixed on August 11, have since entered the CISA KEV catalog. They extend the summer campaign that began with CVE-2026-56164, which has its own brief.

• CVE-2026-58644 (deserialization, CVSS 9.8). Microsoft's revision log says the fix shipped in June, but the CVE "was inadvertently left out of the June 2026 release." On July 15 Microsoft changed the entry to "Exploitation Detected." KEV followed on July 16.
• CVE-2026-50522 (deserialization, 9.8), credited to DEVCORE's splitline. The Hacker News reports that watchTowr saw exploitation after a public proof of concept, with attackers "pulling SharePoint machine keys via a single request." It entered KEV on July 22. Microsoft's entry still reads "Exploitation More Likely."
• CVE-2026-55040 (weak authentication, 9.1). Rapid7's Stephen Fewer found flaws in the JWT validation pipeline that let a remote, unauthenticated attacker act as any user whose SID or UPN they know. The bug was half of a Pwn2Own Berlin chain. Rapid7 published a PoC on August 11, Defused reported honeypot hits soon after (Help Net Security), and KEV followed on August 18.
• CVE-2026-65660 (code injection, 8.8). Microsoft first published it as a spoofing bug and re-titled it as RCE on August 27. Its log then states: "As of 9/25/2026, Microsoft had reliable evidence of observed attacks." KEV added it the same day.

Who is affected#

Only on-premises SharePoint Server Subscription Edition, 2019 and Enterprise Server 2016 are affected. SharePoint Online is not listed in any of the four entries. Each CVE has its own fixed build:

Product	58644 (June)	50522, 55040 (July)	65660 (August)
Subscription Edition	16.0.19725.20384	16.0.19725.20434	16.0.19725.20522
2019	16.0.10417.20153	16.0.10417.20175	16.0.10417.20198
2016	16.0.5556.1005	16.0.5561.1001	16.0.5565.1001

A farm at or above the August build is past every fixed version in the CVE records. According to The Hacker News, the CVE-2026-65660 researcher says SharePoint 2013 is affected too, and it gets no fix.

Do you really need to act?#

If you run SharePoint on-premises and are below the August builds, yes, and today. Don't take much comfort from the "authenticated" wording. For both deserialization bugs, Microsoft's CVSS vector says no privileges are needed, yet its FAQ describes an attacker "authenticated as at least a Site Owner." Defused said its captured requests "carry no authentication material." CVE-2026-55040 removes the login requirement for anyone who knows a target user's UPN or SID, and public exploit code has existed since August 11. Halo Security notes that Shadowserver tracks more than 8,500 internet-reachable SharePoint servers.

CVE-2026-65660 needs a low-privileged account. The researcher, however, showed a pre-auth chain on servers that allow anonymous access and lack a June 9 fix (The Hacker News). The exploitation evidence is thin but real. eSecurity Planet reports that a single Previdian honeypot logged 12 exploit requests on September 24, with an in-memory .NET loader. Stolen machine keys survive patching, so a late patch does not evict anyone.

What to do now#

1. On a farm server, run (Get-SPFarm).BuildVersion and compare it with the August builds above.
2. Install every August package for your version: KB5002893 for Subscription Edition, KB5002894 and KB5002896 for 2019, KB5002905 and KB5002906 for 2016. Then run PSConfig on each server.
3. Rotate machine keys (Update-SPMachineKey), then run iisreset. watchTowr advises rotating any credentials the server could reach.
4. Take the farm off the internet, or put it behind an authenticating Layer 7 reverse proxy, as CISA recommends.
5. Enable AMSI for every web application, per Rapid7. Budget for leaving 2016 and 2019, which eSecurity Planet notes are past extended support.

How to tell if you were hit#

Check Defender and AMSI for Exploit:Script/SuspSignoutReqBody.A and Exploit:Script/ToolPaneAuthBypass.A. For CVE-2026-65660, Previdian's indicators include repeated /_layouts/ segments with AddGallery.aspx or designgallery.aspx, the query job=all&DisplayMode=Edit, form fields MSOTlPn_Uri and MSOTlPn_DWP, a web shell at /_layouts/15/sphealth.aspx, and wt3k3sij.dll with an SdLoader type. For CVE-2026-55040, look in ULS and IIS logs for unusual bearer-token authentication and admin activity. NCSC New Zealand advises isolating unpatched servers from the internet. CISA's KEV entries also call for forensic triage, so preserve logs before you rotate or rebuild anything.

Timeline#

• May 18, 2026 — Rapid7 reports its SharePoint chain to Microsoft.
• Jun 9, 2026 — June updates silently fix CVE-2026-58644.
• Jul 14, 2026 — July updates publish CVE-2026-58644, CVE-2026-50522 and CVE-2026-55040.
• Jul 16, 2026 — CVE-2026-58644 is added to KEV, a day after Microsoft marks it exploited.
• Jul 22, 2026 — CVE-2026-50522 is added to KEV.
• Aug 11, 2026 — August updates fix CVE-2026-65660, and Rapid7 publishes its CVE-2026-55040 PoC.
• Aug 18, 2026 — CVE-2026-55040 is added to KEV.
• Aug 27, 2026 — Microsoft re-titles CVE-2026-65660 as RCE.
• Sep 25, 2026 — Microsoft confirms CVE-2026-65660 attacks, and it is added to KEV.

Vulnerability records

• CVE-2026-58644 · KEV 2026-07-16 · Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
• CVE-2026-50522 · KEV 2026-07-22 · Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
• CVE-2026-55040 · KEV 2026-08-18 · Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
• CVE-2026-65660 · KEV 2026-09-25 · Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2026-58644 SharePoint Remote Code Execution Vulnerability msrc.microsoft.com
2. Microsoft MSRC — CVE-2026-50522 SharePoint Remote Code Execution Vulnerability msrc.microsoft.com
3. Microsoft MSRC — CVE-2026-55040 SharePoint Server Security Feature Bypass Vulnerability msrc.microsoft.com
4. Microsoft MSRC — CVE-2026-65660 SharePoint Server Remote Code Execution Vulnerability msrc.microsoft.com
5. CVE record — CVE-2026-65660 cve.org
6. CISA — Known Exploited Vulnerabilities catalog (JSON feed) cisa.gov
7. Rapid7 — CVE-2026-55040: Microsoft SharePoint JWT authentication bypass (fixed) rapid7.com
8. Rapid7 — ETR: CVE-2026-58644 exploited in the wild rapid7.com
9. NCSC New Zealand — CVE-2026-58644 and CVE-2026-50522 affecting SharePoint Server ncsc.govt.nz
10. Halo Security — CVE-2026-55040: SharePoint authentication bypass added to CISA KEV blog.halosecurity.com

Coverage and analysis

1. The Hacker News — Critical SharePoint RCE CVE-2026-50522 thehackernews.com
2. Help Net Security — Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040) helpnetsecurity.com
3. The Hacker News — SharePoint flaw initially listed as spoofing thehackernews.com
4. eSecurity Planet — SharePoint CVE-2026-65660 exploited as CISA deadline hits esecurityplanet.com