When CISA adds three CVEs to its Known Exploited Vulnerabilities Catalog in a single quarter, you're facing more than a theoretical risk. CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 represent active exploitation campaigns targeting on-premises SharePoint Server instances across Subscription Edition, 2019, and 2016 versions. Yet, the guidance you receive focuses heavily on patching, while threat actors are already stealing IIS machine keys and establishing persistence through deserialization techniques.
These myths persist because they're comforting. Patching feels like control. Antivirus feels like coverage. But when attackers are harvesting machine keys to maintain access even after you patch, your understanding of SharePoint security needs updating.
Myth 1: Patching Closes the Window
The Reality: Patches stop new exploitation vectors, but they don't evict attackers who've already established persistence.
CISA's guidance explicitly tells you to "hunt for and remediate any intrusion artifacts, including machine-key harvesters" before rotating IIS machine keys. Threat actors exploiting these vulnerabilities aren't just executing code; they're stealing the cryptographic secrets that protect ASP.NET view state and authentication tokens. Even after you apply Microsoft's patches, stolen machine keys let attackers forge valid requests indefinitely.
Your patch verification process should include checking that installation completed successfully, but your incident response plan needs to run in parallel. Review SharePoint worker-process activity and webshell indicators before you consider the system clean. If you patch on Tuesday and rotate machine keys on Wednesday without hunting for harvesters first, you've just secured a compromised environment.
Myth 2: AMSI Integration Is Either On or Off
The Reality: AMSI configuration granularity determines what you actually detect.
Microsoft's Antimalware Scan Interface integration with SharePoint offers three request body scan modes, and CISA specifically recommends "Full Mode" where feasible. That matters because the detection signatures CISA highlights target different attack phases. Exploit:Script/SuspSignoutReqBody.A only works with request body scanning on SharePoint Server Subscription Edition. Exploit:Script/ToolPaneAuthBypass.A requires request header scanning across all supported versions.
If you enabled AMSI but left it in a permissive mode to avoid performance impact, you're not getting coverage for the exploitation patterns Microsoft has already observed. Follow the Configure AMSI integration with SharePoint Server guidance for each web application individually, not as a farm-wide toggle you set once and forget.
Myth 3: Microsoft Defender Antivirus Catches Post-Exploitation Activity Automatically
The Reality: You need to know which signatures matter and what they indicate about breach scope.
The Backdoor:MSIL/LeakFang.A!dha signature that Microsoft Defender Antivirus uses to detect post-exploitation activity specifically targets IIS-protected secrets harvesting. When that signature fires, you're not dealing with an attempted exploit; you're dealing with an active breach where attackers have already achieved remote code execution and are now stealing the keys that protect your application's cryptographic operations.
CISA tells you to implement your organization's incident response plan for any positive detections. A LeakFang detection means you need to assume compromise, initiate Containment, Eradication, and Recovery procedures, and treat machine-key rotation as part of remediation, not prevention. Your antivirus isn't a firewall; it's a tripwire telling you the perimeter already failed.
Myth 4: Internet-Facing SharePoint Just Needs a Firewall
The Reality: Layer 3 and Layer 4 controls don't inspect application-layer attacks.
CISA's guidance specifies a Layer 7 reverse proxy or equivalent application-layer security control that can inspect and filter requests. That's because the exploitation chains for CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 involve crafted HTTP requests that look legitimate at the network layer but contain malicious deserialization payloads or authentication bypasses at the application layer.
A traditional firewall sees valid HTTPS traffic to TCP 443. A Layer 7 proxy can enforce authentication before requests reach SharePoint, validate request structure against known attack patterns, and block suspicious parameters that exploit deserialization vulnerabilities. If your SharePoint Server must be internet-accessible, the reverse proxy isn't optional defense-in-depth; it's your primary control against the attack vectors CISA documented.
Myth 5: Logging Comes Standard
The Reality: Default SharePoint telemetry doesn't capture the indicators CISA wants you to monitor.
When CISA recommends "tailored logging mechanisms to detect and monitor exploitation activities," they're acknowledging that out-of-the-box SharePoint logging won't show you anomalous requests, suspicious worker-process activity, or machine-key access attempts. You need to establish custom instrumentation that captures request headers, monitors aspnet_wp.exe behavior, and tracks access to machineKey elements in Web.config files.
Review CISA's Best Practices for Event Logging and Threat Detection for the baseline, but understand that "tailored" means you're configuring SharePoint-specific telemetry that correlates with the AMSI and Microsoft Defender Antivirus signatures. Your SIEM needs to ingest SharePoint ULS logs, IIS logs, and Windows Security Event logs, then correlate them against the exploitation patterns Microsoft documented. Logging isn't about compliance checkbox; it's about detecting the gap between when exploitation occurs and when your antivirus catches it.
What to Do Instead
Start with CISA's hardening checklist, but execute it in the right sequence. Hunt for compromise indicators before you rotate machine keys. Configure AMSI in Full Mode for request body scanning where your performance budget allows. Verify that Microsoft Defender Antivirus signatures are current and that detections trigger your incident response plan, not just ticket creation.
Block external access to SharePoint Central Administration entirely. Restrict farm and database communications to required systems using the role-specific ports documented in Microsoft's SharePoint Server security-hardening guidance. If you're running SharePoint behind a reverse proxy, confirm it's inspecting requests at the application layer, not just terminating SSL.
Review your Web.config settings against Microsoft's Improved ASP.NET view state security and key management guidance. Shorten your patching cycles when possible, but don't mistake patch deployment for breach remediation.
These vulnerabilities were added to CISA's Known Exploited Vulnerabilities Catalog on April 14, July 1, and July 14, 2026. That timeline tells you exploitation is active and persistent. Your hardening program needs to match that reality.
