CVE-2026-56164

This vulnerability lets a remote attacker “skip the front door” (no login required) and gain higher control inside your SharePoint server. Think of it like leaving a keyhole unprotected—someone who can reach your building can potentially reach offices they shouldn’t. CISA reports this is being used in real attacks, not just theoretical testing.

This matters if you run Microsoft SharePoint Server—specifically Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, or sharepoint server. The risk is for systems reachable over the network, and it does not require a login or user action. It is a priority when your SharePoint is network-accessible (for example, reachable from the internet or otherwise reachable by attackers).

This is RED because CISA added CVE-2026-56164 to its Known Exploited Vulnerabilities list and exploitation has been reported as active in the wild. Attackers are using it to bypass authentication and gain elevated privileges remotely, so attackers can move quickly once they find an exposed SharePoint.

1. Inventory and confirm exposure

   • Confirm which SharePoint product you run: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, or sharepoint server.
   • Determine your exact installed SharePoint build/version.
   • Check whether the server is reachable from untrusted networks (network exposure). Because the issue is network-based and does not require authentication, focus on what can be reached by external clients.

2. Verify whether you are on a fixed version

   • Enterprise Server 2016 is fixed in 16.0.5561.1001.
   • Server 2019 is fixed in 16.0.10417.20175.
   • Subscription Edition / sharepoint server is fixed in 16.0.19725.20434.
   • If your build is older than the fixed build for your edition, you are considered exposed.

3. Patch immediately to the fixed version

   • Upgrade to the fixed version listed above for your edition.
   • Follow Microsoft’s update guidance for the specific CVE and your server’s update/maintenance process.

4. If you cannot patch right away (temporary containment)

   • Reduce network exposure to SharePoint as much as possible until the fix is applied (for example, restrict inbound access to only required networks/users).
   • Apply any mitigations described in Microsoft’s remediation guidance for this exact CVE.
   • Coordinate with your IT/vendor to ensure you can meet CISA’s urgency and compliance expectations.

5. Post-update checks (because exploitation is confirmed)

   • Review for suspicious authentication bypass behavior, unexpected privilege/admin changes, and any unusual changes to SharePoint content or configuration.
   • If you find indicators of compromise, follow your incident response plan and consult vendor/forensics guidance.

6. CISA timeline

   • CISA remediation due date: 2026-07-17.
   • CISA also expects stakeholders to evaluate asset internet exposure and follow BOD 26-04 patching priorities and forensics triage requirements as applicable.

Severity is reported as medium by CVSS (5.3) but the operational risk is high because CISA confirmed real-world exploitation and included CVE-2026-56164 in KEV. The weakness is CWE-306 (missing authentication), where a critical function in Microsoft SharePoint Server lacks an authentication check. Preconditions indicate attackers need only network access; no authentication or user interaction is required per the findings. Attack vector is network-based (remote). Exploit maturity: active exploitation reported and KEV-listed; however, no public exploit code is on record (per EXPLOIT finding). KEV means CISA has verified that the vulnerability is being exploited in the wild and expects prioritized remediation per CISA guidance. EPSS details are not provided in the findings, so they are not included here.