A critical SharePoint deserialization flaw is under active exploitation. Applying the security update closes the entry point, but stolen machine keys can preserve attacker access unless recovery goes further.