Storm-2603’s SharePoint Killchain: CVE-2026-55040 + CVE-2026-56164 Turn a Single HTTP Request Into Full Domain Compromise — Patch Before Tomorrow

On the eve of Microsoft’s August 2026 Patch Tuesday, security teams managing on-premises SharePoint deployments face a time-sensitive threat: a two-CVE exploit chain — CVE-2026-55040 (CVSS 9.1) and CVE-2026-56164 (CVSS 9.8) — that strips away every layer of authentication between an attacker and full domain compromise. Storm-2603, a persistent threat group active since mid-2025, is already weaponising this chain in live attacks. If your on-premises SharePoint Server is not patched to July 2026 levels by tomorrow morning, you are exposed to unauthenticated, zero-click remote code execution that can cascade from a single web request into a ransomware incident.

Why This Chain Is Exceptionally Dangerous

Most critical vulnerabilities demand at least a low-privilege account or social engineering to trigger. This chain needs neither. An attacker anywhere on the internet, armed only with a target’s Active Directory Security ID (SID) or User Principal Name (UPN) — both routinely leaked through LinkedIn, email headers, or prior breaches — can forge a valid JWT bearer token and present themselves to SharePoint as a site administrator.

That impersonation is CVE-2026-55040 at work. Once the attacker is operating as an admin, the chained RCE vulnerability (expected in tomorrow’s patch) converts that privileged session into arbitrary code execution on the SharePoint server. No credentials. No phishing link for an employee to click. No MFA bypass. Just a network path to TCP 443 and the knowledge of one employee’s UPN — which any attacker who has ever received an email from your organisation already has.

Rapid7 researcher Stephen Fewer discovered and reported CVE-2026-55040 as part of a Pwn2Own Berlin competition entry, making it a well-documented, publicly-known vulnerability with a clear technical roadmap for exploitation. The authentication-bypass patch landed in July 2026; the partnering RCE patch is expected tomorrow. Between those two patch dates, defenders have a partial safety net — patching the auth bypass breaks the full chain — but the IIS machine-key theft attacks enabled by CVE-2026-56164 are already happening independently.

Technical Breakdown: Six Stages from Web Request to Domain Takeover

Resecurity’s incident response team has reconstructed the full kill chain from live SharePoint attacks into six sequential stages. Understanding each stage clarifies exactly where defenders can sever the chain.

Stage	Attacker Action	Detection Opportunity
1. Recon	Enumerate internet-exposed SharePoint via Shodan, certificate transparency, credential dumps	Threat intel feeds; monitor for your domain in credential dumps
2. Auth Bypass	Forge JWT using victim’s SID/UPN via CVE-2026-55040; escalate via CVE-2026-56164	SIEM alert on unusual admin-level API calls from unknown IPs
3. Web Shell	Drop spinstall0.aspx or similar to TEMPLATE\LAYOUTS or inetpub\wwwroot	File integrity monitoring; unexpected .aspx in system directories
4. Machine-Key Theft	Exfiltrate IIS cryptographic keys via .NET reflection through web shell	w3wp.exe spawning powershell.exe; unusual HTTPS egress from IIS
5. Persistence	Forge ViewState tokens using stolen keys; register malicious IIS native module (survives patches and reboots)	IIS Event ID 29; module registration outside expected paths
6. Lateral Movement	NTLM relay to SQL Server backend; compromise SharePoint farm account; pivot to Active Directory	Unusual SQL auth from IIS process account; AD account anomalies

The most insidious step is stage 5. By registering a native IIS module, Storm-2603 achieves persistence that survives both the application of security patches and server reboots. This means a server that was compromised before patching remains backdoored even after the patch is applied — making threat hunting a prerequisite to patching, not an alternative to it.

Storm-2603: The Threat Actor Behind the Keyboard

Storm-2603 is not an opportunistic script-kiddie operation. The group has systematically targeted government agencies, defence contractors, and financial services firms with internet-exposed, on-premises SharePoint deployments since mid-2025. Their initial vector was CVE-2026-45659, a CVSS 8.8 SharePoint RCE that CISA added to its KEV catalog in July 2026. The current CVE-2026-55040/56164 chain represents an escalation: where CVE-2026-45659 required low-level authentication, the new chain is fully unauthenticated.

Their post-exploitation tradecraft includes staging exfiltrated data in hidden SharePoint document libraries disguised with benign file extensions to evade Data Loss Prevention tools — a technique specifically designed to buy time before incident response teams notice the breach.

For Indian enterprises, this matters acutely. On-premises SharePoint Server remains widely deployed across PSUs, financial institutions, and large enterprises that migrated to Microsoft 365 tenants but retained on-premises farms for compliance, data residency, or legacy application integration. Under India’s Digital Personal Data Protection (DPDP) Act, a breach of a SharePoint server holding employee or customer personal data carries significant notification and potential penalty obligations — making rapid response both a security and a legal imperative.

Indicators of Compromise: What to Hunt For Right Now

If you have any doubt about the integrity of your SharePoint environment, begin threat hunting against these IOCs immediately:

• HTTP POST requests to /_layouts/15/ToolPane.aspx with parameter DisplayMode=Edit
• Spoofed Referer headers pointing to /_layouts/SignOut.aspx
• w3wp.exe spawning cmd.exe, powershell.exe, or net.exe — this is the clearest sign of web shell execution
• New .aspx files appearing in %SystemRoot%\inetpub\wwwroot or TEMPLATE\LAYOUTS
• IIS Event ID 29 indicating unexpected module registration
• Outbound HTTPS connections from w3wp.exe to unknown destinations
• Data staged in SharePoint document libraries with benign extensions (.pdf, .docx) that are unusually large or recently created outside business hours

What You Should Do: Sanjay Seth’s Defensive Checklist

Having worked with enterprise SharePoint deployments across India’s banking, government, and manufacturing sectors for over 30 years, my guidance is unambiguous: treat this as a P0 incident until your environment is confirmed clean and patched.

1. Apply July 2026 patches immediately if not already done. The specific KBs are:
   • SharePoint Server Subscription Edition: KB5002882
   • SharePoint Server 2019: KB5002883
   • SharePoint Enterprise Server 2016: KB5002891

   These patch both CVE-2026-55040 and CVE-2026-56164 and break the authentication-bypass portion of the chain.

2. Apply August Patch Tuesday updates tomorrow (August 11, 2026) the moment they are released — the RCE component patch will complete your protection against this chain.
3. Rotate all IIS machine keys before and after patching. If machine keys were stolen before patching, the attacker still holds persistence through forged ViewState tokens regardless of the patch. Key rotation invalidates that persistence mechanism.
4. Enable AMSI integration on SharePoint and IIS worker processes with Full Request Body Scan mode. Microsoft’s own advisory identifies this as the single most effective mitigation for detecting deserialization-based attacks on SharePoint.
5. Conduct a web shell hunt before declaring victory. Search TEMPLATE\LAYOUTS, inetpub\wwwroot, and all SharePoint hive directories for .aspx files modified in the last 90 days that are not part of the SharePoint installation manifest.
6. Do not expose SharePoint directly to the internet. Place a Layer 7 reverse proxy with pre-authentication in front of any internet-accessible SharePoint instance. This single architectural change would have stopped the initial exploitation vector for the majority of Storm-2603’s victims.
7. Segment SharePoint from SQL Server and Active Directory at the network layer. The lateral movement stage of this chain exploits the implicit trust between the SharePoint app tier and its backend systems — segmentation buys containment time.
8. Forward all IIS and Windows Security logs to your SIEM with alerting configured on w3wp.exe process spawning, IIS module registration events, and admin-level SharePoint API calls from unexpected source IPs.

If you have not reviewed your SharePoint architecture recently, our team at P J Networks has deep experience with Microsoft’s July 2026 zero-day rollup and the broader SharePoint threat landscape — including the IIS machine key theft pattern that Storm-2603 has been refining across multiple CVE campaigns.

Frequently Asked Questions

Does this affect SharePoint Online (Microsoft 365)?

No. CVE-2026-55040 and CVE-2026-56164 affect only on-premises SharePoint Server (2016, 2019, and Subscription Edition). Microsoft manages patching for SharePoint Online, and those deployments are not vulnerable to this exploit chain. If your organisation uses a hybrid topology with some on-premises servers, only the on-premises nodes are at risk.

I applied the July 2026 patches. Am I fully protected?

Partially. The July patches fix CVE-2026-55040 (auth bypass) and CVE-2026-56164 (privilege escalation), breaking the authentication portion of the chain. However, the RCE component that converts impersonation into code execution is patched in tomorrow’s August Patch Tuesday. Apply those updates as soon as they are available. Additionally, if your environment was exposed before July patching, you should hunt for web shells and rotate IIS machine keys regardless of patch status.

How do attackers find the SID or UPN they need to exploit CVE-2026-55040?

Active Directory UPNs are often the same as corporate email addresses — visible on business cards, LinkedIn profiles, email signatures, and any prior breach database. SIDs can sometimes be inferred from LDAP enumeration if anonymous queries are permitted, or extracted from other compromise artefacts. Organisations with good credential hygiene and no prior breach exposure are at lower risk, but the bar for obtaining a UPN is genuinely low for a motivated attacker.

What does Storm-2603 ultimately do once inside?

Based on Resecurity’s incident response findings, Storm-2603’s end-game varies by target. Against government and defence contractors, the group focuses on data exfiltration — staging documents in hidden SharePoint libraries before exfiltrating via encrypted channels. Against commercial targets, the group has deployed ransomware after establishing domain-level persistence. The six-stage kill chain described above gives them domain controller access, from which virtually any outcome — data theft, ransomware, destructive attack — is achievable.

Act Before the Window Closes

Tomorrow’s Patch Tuesday will close the final gap in this exploit chain. That is good news — but it only helps organisations that apply patches promptly. The hard reality is that many on-premises SharePoint deployments run on change-management cycles that can stretch weeks, leaving systems exposed long after patches are available.

If your organisation falls into that category, the intermediate mitigations — AMSI in full-scan mode, the Layer 7 proxy, network segmentation, and machine-key rotation — are not optional niceties. They are the difference between a near-miss and a breach notification under the DPDP Act.

Need help assessing your SharePoint exposure, validating your patch status, or implementing zero-trust network controls around your on-premises Microsoft infrastructure? Contact Sanjay Seth’s team at P J Networks for a security assessment — we’ll give you a clear picture of your risk and a prioritised remediation roadmap before the next threat actor finds you first.