CVE-2026-120002: Microsoft SharePoint Privilege Escalation — Detection and Remediation Guide

---
title: SharePoint w3wp Process Spawning Command Shell or PowerShell
id: 8f4e2c1a-5b7d-4e9f-a3c6-9d1e2f4a5b6c
status: experimental
description: Detects the SharePoint worker process (w3wp.exe) spawning cmd.exe or powershell.exe, indicative of web shell execution or post-exploitation activity following privilege escalation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-120002
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.privilege_escalation
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\pwsh.exe'
falsepositives:
  - Rarely, SharePoint administrators may legitimately run PowerShell from within the farm context, but spawning from the worker process itself is highly anomalous.
level: high
---
title: Suspicious File Write to SharePoint Web Root
id: 2a5b8c3d-4e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects file creation events in SharePoint web application directories (LAYOUTS, CONTROLTEMPLATES, or site collection content) by non-standard processes, suggesting web shell deployment.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-120002
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\LAYOUTS\'
      - '\CONTROLTEMPLATES\'
      - '\_catalogs\'
      - '\SitePages\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.asp'
      - '.php'
      - '.ashx'
      - '.asmx'
  filter_writers:
    Image|endswith:
      - '\w3wp.exe'
      - '\OWSTIMER.EXE'
      - '\msbuild.exe'
  condition: selection_paths and selection_ext and not filter_writers
falsepositives:
  - Legitimate SharePoint customization deployments. Correlate with change management tickets.
level: high

// Hunt for SharePoint worker process spawning suspicious child processes
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, AccountDomain
| sort by TimeGenerated desc

-- Hunt for recently modified script files in SharePoint web directories
SELECT FullPath, Mtime, Size, Mode
FROM glob(globs='C:/Program Files/Common Files/Microsoft Shared/Web Server Extensions/*/TEMPLATE/LAYOUTS/**/*.aspx')
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC

# CVE-2026-120002 SharePoint Verification and Hardening Script
# Run on each SharePoint server in the farm

Write-Host "=== SharePoint CVE-2026-120002 Assessment ===" -ForegroundColor Cyan

# 1. Identify installed SharePoint version
$spRegPath = "HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions"
if (Test-Path $spRegPath) {
    $versions = Get-ChildItem $spRegPath | Select-Object -ExpandProperty PSChildName
    Write-Host "Detected SharePoint versions: $($versions -join ', ')" -ForegroundColor Yellow
} else {
    Write-Host "SharePoint not detected on this system." -ForegroundColor Green
    exit
}

# 2. Check for pending SharePoint updates
Write-Host "`nChecking Windows Update for SharePoint patches..." -ForegroundColor Cyan
$updateSession = New-Object -ComObject Microsoft.Update.Session
$updateSearcher = $updateSession.CreateUpdateSearcher()
$searchResult = $updateSearcher.Search("IsInstalled=0 and Type='Software'")
$spUpdates = $searchResult.Updates | Where-Object { $_.Title -match "SharePoint" }

if ($spUpdates.Count -gt 0) {
    Write-Host "Available SharePoint updates found:" -ForegroundColor Red
    $spUpdates | ForEach-Object { Write-Host " - $($_.Title)" }
    Write-Host "ACTION REQUIRED: Install the April 2026 (or later) SharePoint security update immediately." -ForegroundColor Red
} else {
    Write-Host "No pending SharePoint updates detected via Windows Update." -ForegroundColor Green
}

# 3. Audit recent file modifications in SharePoint LAYOUTS directory
Write-Host "`nScanning LAYOUTS directory for recently modified files..." -ForegroundColor Cyan
$layoutsPath = "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS"
if (Test-Path $layoutsPath) {
    $recentFiles = Get-ChildItem -Path $layoutsPath -Recurse -Include *.aspx,*.ashx,*.asmx | 
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
    if ($recentFiles) {
        Write-Host "Recently modified files detected (potential web shells):" -ForegroundColor Red
        $recentFiles | Select-Object FullName, LastWriteTime | Format-Table -AutoSize
    } else {
        Write-Host "No suspicious recent modifications found." -ForegroundColor Green
    }
}

# 4. Review SharePoint Farm Administrators group
Write-Host "`nReviewing local Administrators and SharePoint Farm Admins..." -ForegroundColor Cyan
try {
    $farmAdmins = Get-SPFarm | Select-Object -ExpandProperty Administrators
    Write-Host "SharePoint Farm Administrators:" -ForegroundColor Yellow
    $farmAdmins | ForEach-Object { Write-Host " - $($_.DisplayName) ($($_.LoginName))" }
} catch {
    Write-Host "Could not enumerate SharePoint Farm Administrators. Ensure SharePoint PowerShell module is loaded." -ForegroundColor Yellow
}

Write-Host "`n=== Assessment Complete ===" -ForegroundColor Cyan
Write-Host "If updates are pending or suspicious files were found, isolate the server and initiate incident response." -ForegroundColor White