URGENT ADVISORY: ToolShell and CVE-2026-33112, SharePoint On-Premises RCE (Unauthenticated, 2025–Present)

TL;DR: On-premises SharePoint Server (2013, 2016, 2019, Subscription Edition) is vulnerable to unauthenticated RCE. Attackers have exploited the ToolShell chain since July 17, 2025 and a subsequent bypass, CVE-2026-33112 (CVSS 8.8, XmlValidator bypass via XSD schema import trick), was published May 12, 2026. Microsoft shipped emergency patches for the original flaw on July 20, 2025 and cumulative fixes for the full wave including CVE-2026-33112, four active-exploitation flaws from the July 14, 2026 Patch Tuesday (CVE-2026-32201, 45659, 56164, 58644), CVE-2026-55040 (JWT bypass, SE-only), and CVE-2026-50522 on July 14 with CISA KEV additions through July 22. SharePoint Online / Microsoft 365 is not affected.

1. WHAT HAPPENED

Microsoft discovered four critical vulnerabilities in on-premises SharePoint Server that attackers exploited in a coordinated chain starting July 2025. Two more bypasses of those fixes appeared through mid-2026:

• CVE-2025-49706 — Authentication bypass via forged Referer header (discovered by Viettel at Pwn2Own Berlin, May 16, 2025)
• CVE-2025-49704 — Remote code execution via insecure deserialization in DataSetSurrogateSelector (co-discovered by Viettel at Pwn2Own Berlin)
• CVE-2025-53770 — Bypass of Microsoft's July 8 Patch Tuesday fix for CVE-2025-49704 (pathinfo appended to the URL)
• CVE-2025-53771 — Bypass of the July 8 Patch Tuesday fix for CVE-2025-49706

The original fixes were patched on July 8, 2025. The bypasses (CVE-2025-53770 and CVE-2025-53771) were confirmed under active exploitation starting July 17, 2025. Microsoft issued emergency out-of-band patches on July 20, 2025. CISA added CVE-2025-53770 to its Known Exploited Vulnerabilities catalog the same day (due date: July 21 for federal agencies).

1b. THE 2026 Bypass and Patch Tuesday Wave

The ToolShell fixes did not close the chain permanently.

CVE-2026-33112 — XmlValidator bypass of the ToolShell fix (published May 12, 2026; CVSS 8.8 HIGH)

This CVE is a deserialization-of-untrusted-data attack that bypasses Microsoft's XmlValidator security control via an XSD <xsd:import> / <xsd:include> trick through PPSAuthoringService.asmx. It is a CWE-502 (deserialization of untrusted data) and affects SharePoint Server Subscription Edition, 2019, and 2016 Enterprise. A public PoC exploit has been released by the Viettel Cyber Security researcher who originally disclosed ToolShell. CISA KEV does NOT currently list this CVE, so active-exploitation status is unverified.

July 14, 2026 Patch Tuesday — six on-premises SharePoint fixes shipped

On July 14, 2026 Microsoft released cumulative fixes for the following vulnerabilities:

• CVE-2026-32201 — already in CISA KEV (per Resecurity blog "Understanding the July 2026 SharePoint Attacks")
• CVE-2026-45659 — deserialization flaw, added to CISA KEV July 1 (due July 4); affects all supported on-prem versions
• CVE-2026-56164 — missing authentication privilege escalation; NVD CVSS 9.8 / Microsoft CNA 5.3 Medium; added to CISA KEV July 14 (due July 17 under BOD 26-04); affects all supported on-prem versions
• CVE-2026-55040 — JWT validation bypass, SharePoint Server Subscription Edition ONLY; not observed in the wild at disclosure; fixed at same build for SE as other July patches
• CVE-2026-58644 — unauthenticated deserialization RCE (CVSS 9.8); added to CISA KEV July 16 (due July 19 under BOD 26-04); affects all supported on-prem versions; this is the original ToolShell-chain CVE that lets attackers drop spinstall0.aspx web shell and exfiltrate machineKey from web.config
• CVE-2026-50522 — unauthenticated deserialization RCE via forged SecurityContextToken at /_trust/default.aspx; CVSS 9.8; added to CISA KEV July 22 (due July 25 under BOD 26-04); the machine-key theft tool for persistence that survives patching

All four active-exploitation CVEs above were added to CISA's KEV within days of disclosure, with deadlines under BOD 26-04 (the new risk-tiered replacement for flat 14-day rule; internet-facing critical software gets the shortest tier). Attackers used CVE-2026-58644 and CVE-2026-50522 to exfiltrate ASP.NET machineKey from web.config, enabling persistent forged-VIEWSTATE authentication that survives patching.

1c. FIXED BUILD KB TABLE — REACH CURRENT PATCH LEVEL

Per Microsoft's update guide (via secondary sources; primary MSRC page returned 403); two Class 3 research sources cross-reference these KB numbers with internal consistency.

2. THE EXPLOIT CHAIN — STEP BY STEP

Stage 1: Authentication Bypass (CVE-2025-49706 → CVE-2025-53771)

An unauthenticated attacker sends a POST request to:

POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit

with a forged Referer header pointing to a benign SharePoint page (e.g., /layouts/SignOut.aspx). This tricks SharePoint's Referer validation into believing the request comes from an authenticated session, granting the attacker access to the ToolPane web-part configuration page without any credentials.

CVE-2025-49706 was the original logic flaw in SharePoint's Referer validation — discovered by Viettel at Pwn2Own Berlin (May 16, 2025). CVE-2025-53771 bypasses Microsoft's July 8 Patch Tuesday fix using the same pathinfo trick appended to the ToolPane.aspx URL.

Stage 2: Remote Code Execution (CVE-2025-49704 → CVE-2025-53770)

Once unauthenticated access to ToolPane.aspx is achieved, the attacker injects a crafted deserialization payload targeting DataSetSurrogateSelector. SharePoint processes this payload, resulting in arbitrary code execution under the IIS worker process (w3wp.exe).

CVE-2025-49704 was the original insecure deserialization flaw (also discovered at Pwn2Own Berlin). CVE-2025-53770 bypasses the July 8 Patch Tuesday fix via pathinfo appending to restore full exploitability despite the validation logic Microsoft added.

Stage 3: Persistence and Key Theft

After code execution, attackers follow a predictable pattern:

• Deploy a webshell — typically spinstall0.aspx or xxx.aspx in the SharePoint LAYOUTS directory
• Extract the ASP.NET machine key from web.config: ValidationKey — used to forge Forms Authentication cookies; DecryptionKey — used to decrypt ViewState payloads; Cryptographic mode (MAC/Encryption algorithm)
• Establish persistent access — With stolen keys, attackers can: Forge Forms Authentication cookies (full admin access); Generate valid ViewState payloads (persistent RCE without any webshell on disk); This backdoor survives server reboots and even re-patching

The third stage is what makes ToolShell uniquely dangerous. Patching alone does not remove an active compromise.

3. AFFECTED VERSIONS

SharePoint Online / Microsoft 365 — NOT AFFECTED. If your SharePoint is hosted in Microsoft's cloud, you do not need to take action for these CVEs. Homelab admins who run SharePoint Server on self-hosted VMs — whether for documentation wikis, intranet portals, or collaboration tools — are in scope. This is not a cloud-only issue.

4. IMMEDIATE MITIGATION

Step 1: Apply the emergency patch

Install the appropriate KB for your version. Do not skip the language pack — Microsoft confirmed the bypass works on unpatched language packs.

Step 2: Enable AMSI integration

Enable Microsoft Defender's Advanced Scripting Monitor (AMSI) on all SharePoint servers. Specifically, enable Full Mode HTTP Request Body scanning. This was Microsoft's and CISA's recommended compensating control before patches were available and remains useful as a defense-in-depth layer.

Step 3: Rotate machine keys — MANDATORY IF EXPOSED

If your SharePoint server has been internet-facing since July 17, 2025, assume the machine key was stolen. Rotate it immediately on every WFE in the farm:

Set-SPMachineKey -WebApplication <SPWebApplicationPipeBind>\Update-SPMachineKey -WebApplication <SPWebApplicationPipeBind>\iisreset.exe

Run this on every SharePoint server in the farm. Without key rotation, attackers retain the ability to forge authentication cookies and generate ViewState payloads indefinitely — even after patching. Extract validationKey and decryptionKey from web.config on each WFE for forensic review (compare pre-rotation baseline) before generating new values.

Step 4: Scan for webshells — add these indicators to the checklist

Check these directories on every SharePoint front-end server:

C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\15\\TEMPLATE\\LAYOUTS\\\\\nC:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\16\\TEMPLATE\\LAYOUTS\\\\

Look for the following web shell indicators observed in post-2025 and July 2026 waves:

• spinstall0.aspx — primary observed webshell (ToolShell-era)
• info3.aspx — secondary webshell indicator (July wave era)
• AssetHandler.axd — handler-level persistence indicator (July wave era)
• xxx.aspx — any additional unknown .aspx files deployed via the ToolShell technique

Step 5: Isolate if you cannot patch immediately

If immediate patching is not feasible, isolate internet-facing SharePoint servers behind a VPN, proxy, or authentication gateway. This is not a long-term solution — apply the patch as soon as possible.

5. DETECTION — WHAT TO LOOK FOR

Web logs (IIS / reverse proxy)

Search for POST requests to ToolPane.aspx?DisplayMode=Edit from unauthenticated or low-integrity users. Look for Referer headers containing signout URLs (/layouts/SignOut.aspx) — this is the auth bypass fingerprint.

File system

New .aspx files appearing in LAYOUTS directories. Modified web.config files with unexpected <machineKey> entries.

Process behavior

PowerShell execution spawned from the SharePoint IIS worker process (w3wp.exe). This is a strong indicator of compromise — w3wp.exe should not be spawning PowerShell or cmd.exe.

AMSI / Defender alerts

Microsoft Defender names these threats:

Exploit:Script/SuspSignoutReq.A

Trojan:Win32/HijackSharePointServer.A

Exploit:Script/SuspSignoutReqBody.A

Trojan:PowerShell/MachineKeyFinder.DA!amsi

IOC Hashes (SHA256)

f5b60a8ead96703080e73a1f79c3e70ff44df271  — spinstall0.aspx webshell\nfe3a3042890c1f11361368aeb2cc12647a6fdae1    — xxx.aspx webshell\n76746b48a78a3828b64924f4aedca2e4c49b6735    — compiled App_Web_spinstall0.aspx DLL

IOC IPs (SentinelOne observed)

96.9.125.147      — "no shell" cluster (fileless, in-memory .NET execution)\n107.191.58.76     — Wave 1 spinstall0.aspx deployment\n104.238.159.149   — Wave 2 spinstall0.aspx deployment\n

Detection indicators (post-exploitation hunting)

• Network calls from SharePoint farm accounts to external hosts on unusual ports (machineKey exfiltration typically uses outbound HTTPS)
• Large encrypted HTTPS egress in 5 MB chunks from SharePoint servers
• IIS globalModule entries for unknown native DLLs (e.g., FarmAuthNative.dll, compiled via spinstall0.aspx build process)
• Process spawning from w3wp.exe to cmd.exe, powershell.exe, certutil.exe
• File creation/modification in _layouts/ directory for unknown aspx or handler files (beyond known ToolShell-era indicators: spinstall0.aspx, info3.aspx, AssetHandler.axd)

6. HOW THIS RELATES TO CVE-2025-49706 AND CVE-2025-49704

This is the critical distinction many articles get wrong:

CVE-2025-53770 and CVE-2025-53771 are not separate vulnerabilities — they are the same exploit technique applied to bypass Microsoft's July 8 Patch Tuesday fixes. The mechanism is pathinfo appended to the ToolPane.aspx URL. This is a "patch-bypass" attack pattern, not a zero-day in the traditional sense. Microsoft assigned CVSS scores of 9.8 (Critical) for CVE-2025-53770 and 6.3 (Medium) for CVE-2025-53771.

CVE-2026-33112 continues this pattern: it is another bypass of a Microsoft security control (XmlValidator instead of the pathinfo technique), affecting SE/2019/2016 Enterprise and requiring patch to build 16.0.19725.20280+.

7. SIGNS YOU'VE BEEN COMPROMISED

New .aspx files in SharePoint LAYOUTS directories (including the new spinstall0.aspx, info3.aspx, AssetHandler.axd indicators from July wave)

Modified web.config with unexpected <machineKey> entries — a forged or modified machineKey is often visible in web.config within minutes of exploitation via CVE-2026-58644 / 50522

PowerShell or cmd.exe spawned from w3wp.exe

Base64-encoded binary payloads decoded to LAYOUTS directories

Unexpected outbound connections from SharePoint servers (machineKey exfiltration typically uses outbound HTTPS)

Large ViewState payloads (>10 KB) — possible forged payloads using stolen keys

Defender alerts: "Possible web shell installation" or "Possible exploitation of SharePoint server vulnerabilities"

If you see any of these, patch first, then rotate machine keys, then scan thoroughly. Patching without key rotation leaves a permanent backdoor.

8. SCALE OF IMPACT

54+ organizations affected across 10 countries (Microsoft + BleepingComputer)

75–85+ servers compromised (Bitsight / DQIndia)

~9,000 services at risk globally (Bitsight estimate)

16,000+ internet-exposed SharePoint servers on Shodan (Viettel Threat Intelligence)

Reportedly ~1,500 internet-facing instances affected as of July 2026 (single-chain source attribution: Zero Hunt citing Censys mapping via Help Net Security)

This advisory is based on Microsoft MSRC, Unit 42, Qualys, SentinelOne, Viettel, Contrast Security, Bitsight, Orca, CISA, and NVD public reporting.

If you run SharePoint Server and it's internet-facing, the probability of being targeted is high.

9. ACTION CHECKLIST

• Verify your SharePoint Server version against the affected table above
• Apply the appropriate emergency KB patch; confirm fixed build matches KB5002891 / KB5002883 / KB5002882 (per July 14, 2026)
• Install the language pack patch if applicable
• Enable AMSI with Microsoft Defender
• If internet-facing since July 17, 2025: rotate machine keys on all farm servers (MANDATORY — do not skip this step)
• Scan LAYOUTS directories for spinstall0.aspx, xxx.aspx, and suspicious .dll files — also look for info3.aspx and AssetHandler.axd web shells (post-July wave indicators)
• Isolate internet-facing servers if patching is delayed
• Audit the SharePoint farm service account's Active Directory footprint: new group memberships, Kerberos delegation changes, service principals created since July 14, 2026 (per operator guidance on residual-compromise hunting)