Active Exploitation of On-Premises SharePoint Server Vulnerabilities (ToolShell-style RCE Chain)

Technical Analysis

The exploited vulnerabilities enable unauthenticated or low-privilege attackers to achieve remote code execution against on-premises SharePoint Server (Subscription Edition, 2019, 2016), followed by post-exploitation techniques including theft of IIS machine keys and abuse of ASP.NET deserialization to forge authentication tokens and maintain persistence. Observed attacker tradecraft includes deployment of webshells and a .NET-based backdoor (detected as Backdoor:MSIL/LeakFang.A!dha) that harvests machine keys for long-term access even after patching, unless keys are rotated post-remediation. Detection signatures such as Exploit:Script/ToolPaneAuthBypass.A/.C and Exploit:Script/SuspSignoutReqBody.A indicate exploitation chains involving authentication bypass in SharePoint's ToolPane functionality and malicious request body/header manipulation. Organizations that host internal RAG pipelines, document-ingestion agents, or LLM-based knowledge assistants connected to SharePoint document libraries are at direct risk, since a compromised SharePoint farm could allow attackers to poison retrieved content, exfiltrate service account credentials/API keys used by agent integrations, or pivot into broader agent-connected infrastructure via stolen machine keys and forged authentication tokens.

Affected Systems

Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 (on-premises only; SharePoint Online/Microsoft 365 not affected). Systems with internet-exposed SharePoint Central Administration or without Layer 7 reverse proxy protection are at highest risk.

Indicators of Compromise

• Backdoor:MSIL/LeakFang.A!dha (MDAV detection)
• Exploit:Script/SuspSignoutReqBody.A (AMSI detection - SharePoint Subscription Edition)
• Exploit:Script/ToolPaneAuthBypass.A (AMSI detection - request header scanning)
• Exploit:Script/ToolPaneAuthBypass.C (AMSI detection - RCE coverage)
• Anomalous SharePoint worker-process (w3wp.exe) activity
• Unexplained IIS machine key access/export attempts
• Webshells dropped in SharePoint web application directories

Remediation Steps

1. 1

   Apply Microsoft Patches Immediately

   Patch all on-premises SharePoint Server instances against CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-55040, and CVE-2026-58644; verify successful installation and shorten future patch cycles.

2. 2

   Enable and Configure AMSI Full Mode

   Ensure AMSI integration is enabled for every SharePoint web application with Request Body Scan Mode set to 'Full Mode' where feasible, and monitor for the listed AMSI/MDAV detection signatures.

3. 3

   Hunt Before Rotating Machine Keys

   Investigate for machine-key harvesters and other intrusion artifacts prior to rotating IIS machine keys, since rotating keys without remediation allows attackers to steal new keys again.

4. 4

   Restrict Internet Exposure

   Avoid exposing SharePoint Servers directly to the internet; if required, place them behind a Layer 7 reverse proxy or equivalent application-layer control with authentication and request inspection.

5. 5

   Harden Central Administration and Farm Access

   Block external access to SharePoint Central Administration, restrict farm/database communications to required systems, and apply Microsoft's SharePoint security-hardening guidance for ports, services, and Web.config settings.

6. 6

   Enhance Logging and Threat Detection

   Deploy tailored logging to detect anomalous requests, suspicious worker-process activity, webshells, and machine-key access, following CISA's event logging best practices.

7. 7

   Audit Agent and Automation Integrations

   Review any AI agent, RAG, or automation integrations connected to SharePoint document libraries for credential exposure, and rotate any API keys or service account credentials used by these integrations.