CISA Confirms Active SharePoint Exploits: What NZ Businesses Using Microsoft 365 Need to Do Now

On July 14, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation of multiple critical Microsoft vulnerabilities, including SharePoint. CISA adding a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue is not a theoretical warning — it means threat actors are actively using these flaws in real attacks against real organisations right now.

For NZ businesses using Microsoft 365, SharePoint Online, or on-premises SharePoint Server, this requires immediate action.

What Is Being Exploited

The July 2026 SharePoint attacks, documented in detail by threat intelligence firm Resecurity, describe a chain from a single web request to full domain compromise. The attack path involves:

1. Exploiting a vulnerability in SharePoint to gain initial code execution
2. Using that foothold to harvest credentials and authentication tokens from the SharePoint environment
3. Using harvested tokens to authenticate to other Microsoft 365 services — Teams, Exchange, OneDrive — without triggering MFA because the session is already authenticated
4. Lateral movement within the Microsoft 365 tenant to establish persistence and access further resources

The critical detail in step 3: once an attacker has a valid session token harvested through SharePoint exploitation, MFA does not protect the downstream services. The authentication already happened. This is the same session-hijacking mechanism seen in the CitrixBleed attacks and is becoming a standard pattern in Microsoft ecosystem attacks.

SharePoint Online vs On-Premises

Microsoft 365 SharePoint Online customers benefit from Microsoft applying security patches automatically at the platform level. This does not mean SharePoint Online customers are unaffected — token harvesting and lateral movement within tenants remains possible through application-layer vulnerabilities even when the underlying infrastructure is patched.

On-premises SharePoint Server customers have a more immediate exposure. If you are running SharePoint Server 2019, 2016, or an earlier version on your own infrastructure, you need to check the Microsoft Security Response Center for applicable patches and apply them immediately. CISA's KEV listing means a Federal Civilian Executive Branch agency in the US is required to patch within days. That urgency applies equally to NZ organisations running the same software.

The Broader Microsoft 365 Security Picture

The SharePoint exploitation campaign is part of a pattern of Microsoft ecosystem attacks that have intensified through 2025 and 2026. Microsoft 365 is targeted at volume because the attack surface is enormous — email, files, collaboration, authentication, and increasingly AI assistants are all within the same trust boundary.

The most impactful controls for NZ Microsoft 365 environments are:

Disable legacy authentication protocols. Basic Auth and other legacy protocols bypass modern authentication and MFA. Microsoft has deprecated them, but some tenants still have them enabled for compatibility reasons. Check your Entra ID sign-in logs for legacy protocol usage and disable if no business-critical dependency exists.

Enable conditional access policies. Conditional access allows you to require MFA, block risky sign-in locations, and enforce compliant device requirements. A Microsoft 365 tenant without conditional access policies is significantly more exposed than one with them configured correctly.

Review and restrict third-party app permissions. OAuth application consent attacks — where users are tricked into granting a malicious app access to their Microsoft 365 data — are increasingly common. Review which third-party applications have access to your tenant and remove any that are not actively used or authorised.

Monitor for token theft indicators. Impossible travel alerts, sign-ins from unusual locations, and MFA fatigue attacks are indicators of credential and token compromise. These alerts should be reviewed and actioned, not dismissed.

Ensure all SharePoint administrators have MFA enforced. Admin accounts without MFA are the highest-leverage target in any Microsoft 365 environment.

What to Do This Week

1. If running on-premises SharePoint Server, check the Microsoft Security Response Center and apply all outstanding patches immediately.
2. Review your Entra ID sign-in logs for anomalous activity in the past 30 days, specifically any legacy authentication protocol usage.
3. Confirm MFA is enforced for all administrator accounts in your Microsoft 365 tenant — not just encouraged, enforced.
4. Enable or review conditional access policies, particularly blocking legacy authentication.
5. Review third-party app consent in your tenant and revoke access for any unrecognised or unused applications.

Microsoft 365 is the productivity backbone of most NZ businesses. Its security configuration deserves the same attention as your physical security and financial controls.

Train your staff to recognise Microsoft-themed phishing and social engineering — SecureAZ

Sources & references

• Microsoft Security Response Center — Security Update Guide
• CISA — Known Exploited Vulnerabilities Catalog
• NCSC NZ — Microsoft 365 Security Configuration