CVE-2026-56164: Microsoft SharePoint Server Elevation of Privilege Vulnerability

CSIRTS triage

What

Missing authentication for a critical function in Microsoft Office SharePoint allows unauthorized privilege elevation.

Who is affected

Users of Microsoft Office SharePoint.

Urgency

Remediation is urgent due to active exploitation of this vulnerability.

Action

Users should apply the latest patches provided by Microsoft.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

Microsoft Security Response Center (INTL · vendor-psirt · site)

Severity

medium — CVSS 5.3

Published

2026-07-14

Exploitation

Observed in the wild (CISA KEV)

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Exploitation confirmedCVE-2026-56164Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 97% of all scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• unknownexploitedSecurity Alert: [Updated] Microsoft Releases July 2026 Security Updatesjpcert
• criticalexploitedMicrosoft security advisory – July 2026 monthly rollup (AV26-698) – Update 3cccs
• criticalexploited2026-009: Critical Vulnerabilities in Microsoft SharePointcert-eu
• unknownexploitedNCSC-2026-0237 [1.02] [H/H] Vulnerabilities Fixed in Microsoft Officencsc-nl
• unknownexploitedNCSC-2026-0237 [1.01] [H/H] Vulnerabilities fixed in Microsoft Officencsc-nl
• criticalexploitedAL26-017 - Critical vulnerabilities impacting Microsoft SharePoint Server – CVE-2026-56164, CVE-2026-55040 and…cccs
• unknownMicrosoft Monthly Security Update (July 2026)hkcert
• unknownMultiple vulnerabilities in Microsoft products (July 15, 2026)cert-fr-avis
• unknownexploitedNCSC-2026-0237 [1.00] [M/H] Vulnerabilities fixed in Microsoft Officencsc-nl
• mediumexploitedCVE-2026-56164: Missing authentication for critical function in Microsoft Office SharePoint allows an unauthor…nvd
• unknownexploitedCISA Urges SharePoint Hardening After New Exploitationscisa
• criticalexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa

Recent advisories for Microsoft SharePoint Server

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• medium[NEW] [medium] Microsoft SharePoint and SharePoint Server: Vulnerability allows Cross-Site Scriptingcert-bund · 2026-07-17
• criticalexploitedAL26-017 - Critical vulnerabilities impacting Microsoft SharePoint Server – CVE-2026-56164, CVE-2026-55040 and…cccs · 2026-07-15
• mediumCVE-2026-55051: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacke…nvd · 2026-07-14
• highCVE-2026-55126: Microsoft SharePoint Server Spoofing Vulnerabilitymsrc · 2026-07-14
• mediumCVE-2026-55135: Microsoft SharePoint Server Spoofing Vulnerabilitymsrc · 2026-07-14
• mediumCVE-2026-55020: Microsoft SharePoint Server Spoofing Vulnerabilitymsrc · 2026-07-14

More from Microsoft Security Response Center

• highCVE-2026-42900: Microsoft Windows App Store Elevation of Privilege Vulnerability2026-07-14
• mediumCVE-2026-55003: Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability2026-07-14
• highCVE-2026-57992: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability2026-07-14
• unknownCVE-2026-13867: Chromium: CVE-2026-13867 Inappropriate implementation in Geolocation2026-07-14
• mediumCVE-2026-59926: Mistune: XSS via unescaped class option in Admonition directive2026-07-14