Microsoft SharePoint Server (all supported on-premises versions)
SharePoint is Microsoft's on-premises collaboration platform used by organisations to host internal websites, share documents, and manage team workflows.
Root Cause
The server deserializes (converts back into executable objects) data submitted through a SharePoint sign-in endpoint without first confirming the data is safe. Think of it like a mail room that opens every package and executes whatever instructions are inside, without checking the sender. Attackers submit a crafted payload that the server converts into runnable code.
Attack Vector
Security firm watchTowr has observed active exploitation following the release of a public proof-of-concept. Attackers are sending a single unauthenticated request to extract the server's machine keys. Those keys can then be used to forge trusted tokens and maintain persistent access even after a patch is applied — which is why credential rotation matters as much as patching here.
Detection Notes
Look for unauthenticated POST requests to SharePoint sign-in endpoints; unexpected machine key access in IIS logs; and any newly persisted .NET deserialization payloads in SharePoint application directories.
Recommended Actions
- Apply Microsoft's July 2026 Patch Tuesday update immediately.
- Rotate machine keys and credentials on any SharePoint server that may have been exposed before patching.
- Review IIS logs for suspicious unauthenticated requests to sign-in endpoints dating back to the PoC release.