CVE-2026-56164: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability

CSIRTS triage

What

There is a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.

Who is affected

Deployments of Microsoft SharePoint Server.

Urgency

Remediation is urgent due to active exploitation of this critical vulnerability.

Action

Apply the necessary patches to secure the affected systems.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CISA Known Exploited Vulnerabilities (US · database · site)

Severity

critical

Published

2026-07-14

Exploitation

Observed in the wild (CISA KEV)

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-56164

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Exploitation confirmedCVE-2026-56164Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 97% of all scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• unknownexploitedSecurity Alert: [Updated] Microsoft Releases July 2026 Security Updatesjpcert
• criticalexploitedMicrosoft security advisory – July 2026 monthly rollup (AV26-698) – Update 3cccs
• criticalexploited2026-009: Critical Vulnerabilities in Microsoft SharePointcert-eu
• unknownexploitedNCSC-2026-0237 [1.02] [H/H] Vulnerabilities Fixed in Microsoft Officencsc-nl
• unknownexploitedNCSC-2026-0237 [1.01] [H/H] Vulnerabilities fixed in Microsoft Officencsc-nl
• criticalexploitedAL26-017 - Critical vulnerabilities impacting Microsoft SharePoint Server – CVE-2026-56164, CVE-2026-55040 and…cccs
• unknownMicrosoft Monthly Security Update (July 2026)hkcert
• unknownMultiple vulnerabilities in Microsoft products (July 15, 2026)cert-fr-avis
• unknownexploitedNCSC-2026-0237 [1.00] [M/H] Vulnerabilities fixed in Microsoft Officencsc-nl
• mediumexploitedCVE-2026-56164: Missing authentication for critical function in Microsoft Office SharePoint allows an unauthor…nvd
• criticalexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa
• unknownexploitedCISA Urges SharePoint Hardening After New Exploitationscisa

Recent advisories for Microsoft SharePoint Server

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• medium[NEW] [medium] Microsoft SharePoint and SharePoint Server: Vulnerability allows Cross-Site Scriptingcert-bund · 2026-07-17
• criticalexploitedAL26-017 - Critical vulnerabilities impacting Microsoft SharePoint Server – CVE-2026-56164, CVE-2026-55040 and…cccs · 2026-07-15
• mediumCVE-2026-55051: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacke…nvd · 2026-07-14
• mediumCVE-2026-55135: Microsoft SharePoint Server Spoofing Vulnerabilitymsrc · 2026-07-14
• highCVE-2026-55126: Microsoft SharePoint Server Spoofing Vulnerabilitymsrc · 2026-07-14
• mediumCVE-2026-55020: Microsoft SharePoint Server Spoofing Vulnerabilitymsrc · 2026-07-14

More from CISA Known Exploited Vulnerabilities

• criticalCVE-2026-20316: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability2026-07-29
• criticalCVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability2026-07-27
• criticalCVE-2026-16812: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability2026-07-27
• criticalCVE-2026-16232: Check Point SmartConsole Improper Authentication Vulnerability2026-07-22
• criticalCVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability2026-07-22