SharePoint on-premises lost its patch route and its support date on the same day

In brief

CISA issued an alert on 14 July 2026 urging hardening of on-premises Microsoft SharePoint Server after new exploitation. Two details determine what a response actually has to cover.

First, the observed activity goes beyond remote code execution to theft of IIS machine keys, with deserialisation used for persistence and malware deployment. An attacker holding the machine keys can forge authentication payloads that a patched server will still accept. Patching closes the entry route; it does not remove the key material already taken.

Second, 14 July 2026 was also the end of extended support for SharePoint 2016 and SharePoint 2019. The alert's coverage of all supported versions was accurate on the day it was published and is stale now: only Subscription Edition remains supported.

Why this is a migration decision, not a patch cycle

Most organisations running SharePoint on-premises are doing so because a migration was deferred, usually for integration or compliance reasons rather than cost. That deferral has now converted into an unpatched-platform position by default.

The patched builds for the supported estate are Subscription Edition 16.0.19725.20434, SharePoint 2019 16.0.10417.20175 and SharePoint 2016 16.0.5561.1001. For the two older releases, those builds are the end of the line rather than a baseline to maintain.

A disciplined response

Rotate the ASP.NET machine keys and restart IIS after patching — the patch alone leaves stolen keys valid. Then hunt rather than assume: look for web shells and unexpected files in the LAYOUTS directory, unexpected w3wp.exe child processes, and authentication events consistent with forged tokens rather than credential use.

For SharePoint 2016 and 2019, treat the security work as containment while a migration decision is taken, not as a return to a steady state. There is no future patch for a newly disclosed flaw on those versions.

What leaders should take from it

The item for a risk committee is not this alert. It is the general case it illustrates: an end-of-support date on a system holding authentication material is a security deadline, and it arrives whether or not the migration programme is ready. Any remaining on-premises platform with a support end date inside the next four quarters deserves the same question asked now rather than on the day an alert lands.

Sources and scope

The exploitation description, the machine-key theft and the hardening guidance are from CISA's 14 July 2026 alert. Patched build numbers are from the corresponding Microsoft support articles (5002882, 5002883, 5002891).

This briefing deliberately does not list CVE identifiers. A candidate six-CVE set did not survive verification, and there is a known discrepancy between Tenable's 16 July account and later CISA material on two of them. The qualitative finding — all then-supported versions affected, machine keys stolen, patching insufficient on its own — is what the sources support. CISA's site blocks automated retrieval, so a reader acting on this should open the alert directly. The migration framing and the response sequence are ByteNib editorial analysis.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.