SharePoint Server zero-day actively exploited: CISA warns of IIS key theft to survive patches

Attackers are actively exploiting vulnerabilities in on-premises SharePoint Server to gain Farm Administrator rights and steal IIS machine keys to maintain access even after applying a patch.

What's happening

The CISA (Cybersecurity and Infrastructure Security Agency) has issued an alert about active exploitation of vulnerabilities in SharePoint Server on-premises—local installations, not SharePoint Online (Microsoft 365). Attackers are targeting CVEs that allow them to obtain Farm Administrator rights, the highest level of access on a SharePoint farm.

A documented feature of this campaign: attackers steal IIS (Internet Information Services) machine keys to ensure persistence. These keys allow them to decrypt Windows authentication tokens and forge new valid tokens—which means the attacker can survive patch application if the keys are not regenerated after remediation.

Who is impacted

SharePoint Server on-premises only. At risk are large enterprises, government agencies, and institutions that maintain their own SharePoint farms without migrating to Microsoft 365.

Facts vs. analysis

Facts:

• Active exploitation confirmed by CISA
• Vector: CVEs targeting escalation to Farm Admin on SharePoint on-premises
• Documented persistence technique: theft of IIS machine keys

Analysis: The technique of stealing IIS keys is particularly insidious. Applying the patch is not enough to evict an attacker who has already stolen them: they can continue forging valid tokens as long as the keys are not regenerated. This persistence can remain active for weeks after remediation if this step is overlooked.