CVE-2026-56192
Actively exploited. CVE-2026-56192 is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild, and US federal agencies are required to remediate it under BOD 22-01. Treat patching as urgent.
Microsoft has fixed vulnerabilities in various Office products, such as Word, Excel, PowerPoint, and SharePoint. An attacker can exploit these vulnerabilities to carry out attacks that may lead to categories of damage, as outlined in the table below. For successful exploitation, the attacker must deceive the victim into opening a malicious file or following a link, except for SharePoint. Successful exploitation of vulnerabilities in SharePoint does not require user interaction, other than following a malicious link. Microsoft has confirmed in an update that the SharePoint vulnerability CVE-2026-58644 has been actively exploited as a zero-day. The NCSC recommends updating vulnerable SharePoint systems to the latest version as soon as possible to prevent exploitation. The vulnerability CVE-2026-58644 is a deserialization vulnerability that could be exploited to execute code remotely. The vulnerability CVE-2026-58644 may be exploited in conjunction with the SharePoint vulnerability CVE-2026-56164 by an attacker to execute code remotely without authentication. The vulnerability CVE-2026-56164 is a privilege escalation vulnerability that could be exploited to elevate rights within a network. UPDATE: According to watchTowr, a public exploit code for the SharePoint vulnerability CVE-2026-50522 has been published and is now actively exploited on on-premise versions of SharePoint. Malicious actors can exploit this vulnerability to gain long-term access to networks of vulnerable systems by stealing machine keys.
Microsoft Office SharePoint: |----------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |----------------|------|-------------------------------------| | CVE-2026-54108 | 6.50 | Impersonate another user | | CVE-2026-56164 | 5.30 | Gain elevated rights | | CVE-2026-5052
CSIRTS triage
- What
- A deserialization vulnerability in SharePoint can be exploited to execute code remotely.
- Who is affected
- Deployments of SharePoint that are vulnerable to CVE-2026-58644.
- Urgency
- Remediation is urgent due to active exploitation of the vulnerability as a zero-day.
- Action
- Update vulnerable SharePoint systems to the latest version as soon as possible.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-56192
Get an email if CVE-2026-56192 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Exploitation confirmedAlready exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 35% of all EPSS-scored CVEs.
Advisory coverage (5)
- unknownexploitedNCSC-2026-0237 [1.02] [H/H] Vulnerabilities Fixed in Microsoft Officencsc-nl · 2026-07-21
- unknownexploitedNCSC-2026-0237 [1.01] [H/H] Vulnerabilities fixed in Microsoft Officencsc-nl · 2026-07-17
- unknownexploitedNCSC-2026-0237 [1.00] [M/H] Vulnerabilities fixed in Microsoft Officencsc-nl · 2026-07-14
- mediumCVE-2026-56192: Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information…nvd · 2026-07-14
- mediumCVE-2026-56192: Microsoft Office Information Disclosure Vulnerabilitymsrc · 2026-07-14
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-56192)