---
title: "SharePoint: Four July-August 2026 Flaws Now Exploited"
url: https://erroneo.us/security/briefs/sharepoint-cve-2026-58644-50522-55040-65660-exploited/
description: "Two deserialization RCEs, a JWT auth bypass and a code injection in on-prem SharePoint are in CISA KEV. Get to the August 2026 builds, rotate keys, hunt."
type: security-brief
section: "Security Digest"
date_published: 2026-07-14
date_modified: 2026-09-25
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-58644", "CVE-2026-50522", "CVE-2026-55040", "CVE-2026-65660"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# SharePoint: Four July-August 2026 Flaws Now Exploited

**Verdict: Act now.** Any on-premises SharePoint farm not yet on the August 2026 builds is exposed to exploited bugs with public exploit code; patch, rotate machine keys and check for compromise now.

- **Who must act:** Anyone running on-premises SharePoint Server Subscription Edition, 2019 or 2016, above all farms reachable from the internet or allowing anonymous access.
- **Who can relax:** SharePoint Online (Microsoft 365) customers, who are not listed as affected, and on-prem farms that were on the August 2026 builds by mid-August and are not internet-facing.
- **Affected:** SharePoint Server Subscription Edition before 16.0.19725.20522; SharePoint Server 2019 before 16.0.10417.20198; SharePoint Enterprise Server 2016 before 16.0.5565.1001; SharePoint Server 2013 (out of support; researcher says affected by CVE-2026-65660, no fix)
- **Fixed:** Subscription Edition 16.0.19725.20522 (KB5002893); SharePoint Server 2019 16.0.10417.20198 (KB5002894 and KB5002896); SharePoint Enterprise Server 2016 16.0.5565.1001 (KB5002905 and KB5002906)
- **CVEs:** CVE-2026-58644, CVE-2026-50522, CVE-2026-55040, CVE-2026-65660
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check each farm's build with (Get-SPFarm).BuildVersion and compare it with the August 2026 builds.
2. Install every August 2026 SharePoint package Microsoft lists for your version, then run PSConfig on each server.
3. Rotate ASP.NET machine keys (Update-SPMachineKey) and run iisreset after patching.
4. Remove direct internet exposure, or put the farm behind an authenticating Layer 7 reverse proxy.
5. Enable AMSI integration for every SharePoint web application.
6. Plan the move off SharePoint 2016 and 2019, which are past extended support.

### How to check if you are affected

- Review Defender/AMSI alerts for Exploit:Script/SuspSignoutReqBody.A and Exploit:Script/ToolPaneAuthBypass.A.
- Search IIS logs for repeated /_layouts/ segments with AddGallery.aspx or designgallery.aspx, the query job=all&DisplayMode=Edit, and form fields MSOTlPn_Uri or MSOTlPn_DWP.
- Look for /_layouts/15/sphealth.aspx and for wt3k3sij.dll or an SdLoader type in memory or on disk.
- Check ULS and IIS logs for unusual bearer-token logins and admin activity from unfamiliar addresses since August 11.

## What happened

Three on-premises SharePoint bugs fixed in Microsoft's July 14, 2026 updates, and a fourth fixed on August 11, have since entered the [CISA KEV catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json). They extend the summer campaign that began with CVE-2026-56164, which has its own brief.

- **[CVE-2026-58644](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644)** (deserialization, CVSS 9.8). Microsoft's revision log says the fix shipped in June, but the CVE "was inadvertently left out of the June 2026 release." On July 15 Microsoft changed the entry to "Exploitation Detected." KEV followed on July 16.
- **[CVE-2026-50522](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522)** (deserialization, 9.8), credited to DEVCORE's splitline. [The Hacker News](https://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.html) reports that watchTowr saw exploitation after a public proof of concept, with attackers "pulling SharePoint machine keys via a single request." It entered KEV on July 22. Microsoft's entry still reads "Exploitation More Likely."
- **[CVE-2026-55040](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040)** (weak authentication, 9.1). [Rapid7's](https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/) Stephen Fewer found flaws in the JWT validation pipeline that let a remote, unauthenticated attacker act as any user whose SID or UPN they know. The bug was half of a Pwn2Own Berlin chain. Rapid7 published a PoC on August 11, Defused reported honeypot hits soon after ([Help Net Security](https://www.helpnetsecurity.com/2026/08/13/microsoft-sharepoint-cve-2026-55040-poc-exploit/)), and KEV followed on August 18.
- **[CVE-2026-65660](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660)** (code injection, 8.8). Microsoft first published it as a spoofing bug and re-titled it as RCE on August 27. Its log then states: "As of 9/25/2026, Microsoft had reliable evidence of observed attacks." KEV added it the same day.

## Who is affected

Only on-premises SharePoint Server Subscription Edition, 2019 and Enterprise Server 2016 are affected. SharePoint Online is not listed in any of the four entries. Each CVE has its own fixed build:

| Product | 58644 (June) | 50522, 55040 (July) | 65660 (August) |
|---|---|---|---|
| Subscription Edition | 16.0.19725.20384 | 16.0.19725.20434 | 16.0.19725.20522 |
| 2019 | 16.0.10417.20153 | 16.0.10417.20175 | 16.0.10417.20198 |
| 2016 | 16.0.5556.1005 | 16.0.5561.1001 | 16.0.5565.1001 |

A farm at or above the August build is past every fixed version in the [CVE records](https://www.cve.org/CVERecord?id=CVE-2026-65660). According to The Hacker News, the CVE-2026-65660 researcher says SharePoint 2013 is affected too, and it gets no fix.

## Do you really need to act?

If you run SharePoint on-premises and are below the August builds, yes, and today. Don't take much comfort from the "authenticated" wording. For both deserialization bugs, Microsoft's CVSS vector says no privileges are needed, yet its FAQ describes an attacker "authenticated as at least a Site Owner." Defused said its captured requests "carry no authentication material." CVE-2026-55040 removes the login requirement for anyone who knows a target user's UPN or SID, and public exploit code has existed since August 11. [Halo Security](https://blog.halosecurity.com/cve-2026-55040-sharepoint-authentication-bypass/) notes that Shadowserver tracks more than 8,500 internet-reachable SharePoint servers.

CVE-2026-65660 needs a low-privileged account. The researcher, however, showed a pre-auth chain on servers that allow anonymous access and lack a June 9 fix ([The Hacker News](https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html)). The exploitation evidence is thin but real. [eSecurity Planet](https://www.esecurityplanet.com/cybersecurity-threats/news-sharepoint-cve-2026-65660-active-exploitation) reports that a single Previdian honeypot logged 12 exploit requests on September 24, with an in-memory .NET loader. Stolen machine keys survive patching, so a late patch does not evict anyone.

## What to do now

1. On a farm server, run `(Get-SPFarm).BuildVersion` and compare it with the August builds above.
2. Install every August package for your version: KB5002893 for Subscription Edition, KB5002894 and KB5002896 for 2019, KB5002905 and KB5002906 for 2016. Then run `PSConfig` on each server.
3. Rotate machine keys (`Update-SPMachineKey`), then run `iisreset`. watchTowr advises rotating any credentials the server could reach.
4. Take the farm off the internet, or put it behind an authenticating Layer 7 reverse proxy, as CISA recommends.
5. Enable AMSI for every web application, per [Rapid7](https://www.rapid7.com/blog/post/etr-cve-2026-58644-microsoft-sharepoint-server-unauthenticated-remote-code-execution-vulnerability-exploited-in-the-wild/). Budget for leaving 2016 and 2019, which eSecurity Planet notes are past extended support.

## How to tell if you were hit

Check Defender and AMSI for `Exploit:Script/SuspSignoutReqBody.A` and `Exploit:Script/ToolPaneAuthBypass.A`. For CVE-2026-65660, Previdian's indicators include repeated `/_layouts/` segments with `AddGallery.aspx` or `designgallery.aspx`, the query `job=all&DisplayMode=Edit`, form fields `MSOTlPn_Uri` and `MSOTlPn_DWP`, a web shell at `/_layouts/15/sphealth.aspx`, and `wt3k3sij.dll` with an `SdLoader` type. For CVE-2026-55040, look in ULS and IIS logs for unusual bearer-token authentication and admin activity. [NCSC New Zealand](https://www.ncsc.govt.nz/alerts/cve-2026-58644-affecting-sharepoint-server/) advises isolating unpatched servers from the internet. CISA's KEV entries also call for forensic triage, so preserve logs before you rotate or rebuild anything.

## Timeline

- May 18, 2026 — Rapid7 reports its SharePoint chain to Microsoft.
- Jun 9, 2026 — June updates silently fix CVE-2026-58644.
- Jul 14, 2026 — July updates publish CVE-2026-58644, CVE-2026-50522 and CVE-2026-55040.
- Jul 16, 2026 — CVE-2026-58644 is added to KEV, a day after Microsoft marks it exploited.
- Jul 22, 2026 — CVE-2026-50522 is added to KEV.
- Aug 11, 2026 — August updates fix CVE-2026-65660, and Rapid7 publishes its CVE-2026-55040 PoC.
- Aug 18, 2026 — CVE-2026-55040 is added to KEV.
- Aug 27, 2026 — Microsoft re-titles CVE-2026-65660 as RCE.
- Sep 25, 2026 — Microsoft confirms CVE-2026-65660 attacks, and it is added to KEV.

## Sources

1. [Microsoft MSRC — CVE-2026-58644 SharePoint Remote Code Execution Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644)
2. [Microsoft MSRC — CVE-2026-50522 SharePoint Remote Code Execution Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522)
3. [Microsoft MSRC — CVE-2026-55040 SharePoint Server Security Feature Bypass Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040)
4. [Microsoft MSRC — CVE-2026-65660 SharePoint Server Remote Code Execution Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660)
5. [CVE record — CVE-2026-65660](https://www.cve.org/CVERecord?id=CVE-2026-65660)
6. [CISA — Known Exploited Vulnerabilities catalog (JSON feed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
7. [Rapid7 — CVE-2026-55040: Microsoft SharePoint JWT authentication bypass (fixed)](https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/)
8. [Rapid7 — ETR: CVE-2026-58644 exploited in the wild](https://www.rapid7.com/blog/post/etr-cve-2026-58644-microsoft-sharepoint-server-unauthenticated-remote-code-execution-vulnerability-exploited-in-the-wild/)
9. [NCSC New Zealand — CVE-2026-58644 and CVE-2026-50522 affecting SharePoint Server](https://www.ncsc.govt.nz/alerts/cve-2026-58644-affecting-sharepoint-server/)
10. [Halo Security — CVE-2026-55040: SharePoint authentication bypass added to CISA KEV](https://blog.halosecurity.com/cve-2026-55040-sharepoint-authentication-bypass/)
11. [The Hacker News — Critical SharePoint RCE CVE-2026-50522](https://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.html)
12. [Help Net Security — Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040)](https://www.helpnetsecurity.com/2026/08/13/microsoft-sharepoint-cve-2026-55040-poc-exploit/)
13. [The Hacker News — SharePoint flaw initially listed as spoofing](https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html)
14. [eSecurity Planet — SharePoint CVE-2026-65660 exploited as CISA deadline hits](https://www.esecurityplanet.com/cybersecurity-threats/news-sharepoint-cve-2026-65660-active-exploitation)

---
Source page: https://erroneo.us/security/briefs/sharepoint-cve-2026-58644-50522-55040-65660-exploited/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt