The SharePoint Zero-Day (CVE-2026-32201): Detection, Patching, and Hunt Guide

A zero-day remote-code-execution flaw in on-prem Microsoft SharePoint (CVE-2026-32201) is being actively exploited at scale — 1,300+ servers affected at disclosure. If you run on-prem SharePoint, treat it as compromised until proven otherwise.

Why on-prem SharePoint keeps getting hit

SharePoint is internet-facing, deeply integrated with identity (it holds tokens and service accounts), and slow to patch in many estates. An unauthenticated RCE there is a direct path to the rest of the domain — which is why these flaws are weaponised within days of disclosure.

Act now: a short runbook

1. Patch immediately with the Microsoft out-of-band update; if you cannot patch within hours, take the server off the public internet.
2. Rotate the ASP.NET machine keys. RCE on SharePoint commonly leaks the machine keys, which let an attacker forge valid payloads even after patching — rotation is not optional.
3. Rotate service-account and app credentials the server could reach.

What to hunt for

• Unexpected .aspx files written under the SharePoint LAYOUTS path (web shells).
• w3wp.exe spawning cmd.exe or powershell.exe — a classic post-exploitation tell.
• Outbound connections from the SharePoint server to unfamiliar hosts.

# Find recently-written aspx under the SharePoint layouts dir
Get-ChildItem -Path "C:Program FilesCommon FilesMicrosoft SharedWeb Server Extensions*TEMPLATELAYOUTS" -Recurse -Include *.aspx |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) }

For Indian regulated entities

If this server processed personal data, the DPDP 72-hour and CERT-In 6-hour clocks may apply the moment you confirm compromise. RingSafe runs rapid compromise assessments and IR for exactly this. Get incident support.