SharePoint Server elevation of privilege — missing authentication for critical function
SharePoint Server ships a critical function that's reachable without authentication, letting an unauthenticated attacker escalate over a network. Exploited in the wild; added to CISA KEV 2026-07-14.
- Vendor
- Microsoft
- Product
- Microsoft SharePoint Server (see MSRC advisory for affected builds)
- CVSS
- 5.3
- EPSS (exploit probability)
- 1.0%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-56164 being exploited?
Yes. CISA added CVE-2026-56164 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.0% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-56164 is a missing-authentication-for-critical-function vulnerability in Microsoft SharePoint Server. Per Microsoft’s advisory, an unauthorized attacker can use it to elevate privileges over a network. NVD scores it 5.3 (medium); Microsoft rates it Moderate. Microsoft notes that enabling AMSI plus Request Body Scan mitigates it — the patch is what actually closes it.
Microsoft shipped the fix in the July 2026 Patch Tuesday release on 2026-07-14 and confirmed active exploitation. CISA added the CVE to the Known Exploited Vulnerabilities catalog the same day, bringing it under BOD 26-04 remediation timelines.
Note: SharePoint received a second, separately disclosed vulnerability in the same 24-hour window — Rapid7’s CVE-2026-55040, a JWT authentication bypass that forms the first half of a pre-auth RCE chain. Both should be applied together.
See the write-up: Microsoft July Patch Tuesday: 570 CVEs, 3 zero-days out.
Other Microsoft SharePoint CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 2.1% | |
| CVE-2026-55040 SharePoint Server JWT token authentication bypasswrite-up | [ CRITICAL ] | 9.1 | 69.5% | |
| CVE-2026-50522 SharePoint Server deserialization of untrusted data RCEwrite-up | [ CRITICAL ] | 9.8 | 3.0% | |
| CVE-2026-58644 Microsoft SharePoint deserialization of untrusted data (unauth RCE)write-up | [ CRITICAL ] | 9.8 | 15.9% | |
| CVE-2026-45659 Microsoft SharePoint Server deserialization remote code executionransomware usewrite-up | [ HIGH ] | 8.8 | 2.7% | |
| CVE-2026-32201 SharePoint Server spoofing via improper input validationwrite-up | [ MEDIUM ] | 6.5 | 43.4% | |
| CVE-2026-20963 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 29.2% | |
| CVE-2025-49706 Microsoft SharePoint Improper Authentication Vulnerabilityransomware use | [ MEDIUM ] | 6.5 | 99.1% |
