CVE-2026-55040: SharePoint Authentication Bypass Under Active Exploitation — Detection and Remediation Guide

---
title: SharePoint IIS Worker Process Spawning Command Shell or Script Interpreter
id: 9c1e4b72-3a6d-4f58-b21a-7e5d0c8f4a91
status: experimental
description: Detects w3wp.exe hosting SharePoint spawning cmd.exe, PowerShell, or other script interpreters — a hallmark of webshell post-exploitation following SharePoint compromise such as CVE-2026-55040.
references:
  - https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html
  - https://attack.mitre.org/techniques/T1505/003/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\nltest.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare — legitimate SharePoint administrative tooling may spawn shells from w3wp in some custom solutions; validate against change records
level: high
---
title: Webshell or Suspicious File Dropped in SharePoint Hive Directories
id: 4d7a2f15-8c3e-49b1-a6d4-2f9e1b5c7d38
status: experimental
description: Detects creation of ASPX/ASP/script files in SharePoint TEMPLATE and LAYOUTS directories by the IIS worker process or other non-standard writers, consistent with webshell deployment after authentication bypass exploitation.
references:
  - https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Web Server Extensions\'
      - '\TEMPLATE\LAYOUTS\'
      - '\TEMPLATE\IMAGES\'
      - '\TEMPLATE\ADMIN\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.asp'
      - '.ashx'
      - '.asmx'
      - '.php'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate SharePoint feature deployment or solution packages writing to LAYOUTS — correlate with scheduled deployments and patching windows
level: high
---
title: Suspicious Reconnaissance or Execution Commands Under SharePoint Context
id: 2b8e6c41-5d9a-4f73-b812-6a3c0d4e9f27
status: experimental
description: Detects discovery and staging command lines commonly executed through SharePoint webshells following exploitation of authentication bypass vulnerabilities such as CVE-2026-55040.
references:
  - https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html
  - https://attack.mitre.org/techniques/T1033/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.discovery
  - attack.t1033
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_cli:
    CommandLine|contains:
      - 'whoami'
      - 'ipconfig /all'
      - 'net user'
      - 'net group "domain admins"'
      - 'nltest /dclist'
      - 'certutil -decode'
      - 'certutil -urlcache'
      - 'FromBase64String'
      - 'IEX'
  condition: selection_parent and selection_cli
falsepositives:
  - Very uncommon in normal SharePoint operation; legitimate monitoring agents may run discovery commands but typically not under w3wp.exe
level: critical

// Hunt: SharePoint w3wp.exe spawning shells, discovery, or download tooling
// Scope: all SharePoint web front ends; extend timeframe for retro-hunt to Patch Tuesday (July 2026)
let Lookback = 14d;
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe", "mshta.exe", "rundll32.exe", "whoami.exe", "net.exe", "net1.exe", "nltest.exe", "certutil.exe", "bitsadmin.exe", "curl.exe"]);
DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ (SuspiciousChildren)
| extend SharePointContext = InitiatingProcessCommandLine has "SharePoint"
| project TimeGenerated, DeviceName, SharePointContext,
          InitiatingProcessCommandLine, FileName, ProcessCommandLine,
          AccountName, InitiatingProcessAccountName, SHA256, ReportId
| order by TimeGenerated desc

// Companion hunt: network connections from the SharePoint worker process to rare external destinations
DeviceNetworkEvents
| where TimeGenerated >= ago(Lookback)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), Destinations = make_set(RemoteUrl, 20), Ports = make_set(RemotePort)
    by DeviceName, RemoteIP
| where ConnectionCount > 50 or array_length(Destinations) > 0
| order by ConnectionCount desc

-- Hunt for webshell artifacts in SharePoint hive directories and suspicious w3wp child processes
-- Deploy against all SharePoint web front-end servers

-- 1) Recently created script content in SharePoint TEMPLATE directories (webshell staging)
LET hive_files = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Program Files/Common Files/microsoft shared/Web Server Extensions/*/TEMPLATE/**/*.aspx',
                 'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/*/TEMPLATE/**/*.ashx',
                 'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/*/TEMPLATE/**/*.asmx'])
WHERE Ctime > timestamp(epoch=1780000000)  -- adjust to pre-Patch-Tuesday window for retro-hunt
ORDER BY Ctime DESC

-- 2) w3wp.exe processes with suspicious children (live webshell execution)
LET susp_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(cmd|powershell|pwsh|cscript|wscript|mshta|certutil|whoami|net)\.exe$'

LET joined = SELECT p.Pid AS ChildPid, p.Name AS ChildName, p.CommandLine AS ChildCmd,
       p.Username AS ChildUser, p.CreateTime AS ChildCreate,
       parent.Name AS ParentName, parent.CommandLine AS ParentCmd
FROM susp_procs AS p
JOIN pslist() AS parent ON p.Ppid = parent.Pid
WHERE parent.Name =~ 'w3wp.exe'

SELECT * FROM joined

# CVE-2026-55040 - SharePoint patch verification and exposure audit
# Run elevated on each SharePoint web front end / app server

# 1) Verify installed SharePoint build against July 2026 CU baseline
$spProducts = Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like "*SharePoint*" } |
  Select-Object DisplayName, DisplayVersion, InstallDate
$spProducts | Format-Table -AutoSize

# Cross-check the farm build: compare (Get-SPFarm).BuildVersion against the
# July 2026 CU build number listed in Microsoft's CVE-2026-55040 advisory.
try {
  Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop
  $farm = Get-SPFarm
  Write-Host "Farm BuildVersion: $($farm.BuildVersion)"
  Write-Host "ACTION: Confirm this build is at or above the July 2026 CU in the Microsoft advisory."
} catch {
  Write-Host "SharePoint snap-in unavailable - run on a SharePoint server."
}

# 2) Enumerate externally reachable bindings (exposure check)
Import-Module WebAdministration
Get-WebBinding | Select-Object protocol, bindingInformation |
  Format-Table -AutoSize

# 3) Audit for potential webshell drops in the SharePoint hive (last 30 days)
$hive = "C:\Program Files\Common Files\microsoft shared\Web Server Extensions"
Get-ChildItem -Path $hive -Recurse -Include *.aspx,*.ashx,*.asmx,*.asp -ErrorAction SilentlyContinue |
  Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-30) } |
  Select-Object FullName, CreationTime, LastWriteTime, Length |
  Sort-Object CreationTime -Descending | Format-List

# 4) Confirm July 2026 security updates are installed at OS level
Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date "2026-07-01") } |
  Sort-Object InstalledOn -Descending | Format-Table HotFixID, Description, InstalledOn -AutoSize