CVE-2026-56157: Microsoft SharePoint Server Auth Bypass

CVE-2026-56157 Overview

CVE-2026-56157 is an improper access control vulnerability in Microsoft Office SharePoint that allows an authenticated attacker to perform spoofing over a network. The flaw is tracked under CWE-284: Improper Access Control and affects both SharePoint Server 2016, 2019, and the Subscription Edition. Exploitation requires low-privileged network access but no user interaction, and can be leveraged to misrepresent identities or resources to legitimate users.

Critical Impact
An authorized attacker with network access to a vulnerable SharePoint Server can spoof trusted content or identities, undermining the integrity of collaboration workflows and enabling downstream social engineering or phishing campaigns.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 (Enterprise)

Discovery Timeline

2026-07-14 - CVE-2026-56157 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-56157

Vulnerability Analysis

The vulnerability stems from improper access control checks within Microsoft SharePoint Server. An attacker who is already authenticated to the SharePoint environment can send crafted network requests that bypass expected authorization boundaries. Because the flaw enables spoofing rather than direct code execution, the primary risk is to the integrity of content and identity representation within SharePoint sites.

The attack vector is network-based with low attack complexity. The attacker needs only low privileges, such as those of a standard SharePoint user, and no user interaction is required. Successful exploitation yields limited confidentiality and integrity impact, with no availability impact.

Root Cause

The root cause is classified as CWE-284: Improper Access Control. SharePoint fails to consistently enforce authorization checks on certain resources or actions, allowing an authenticated user to perform operations that should be restricted. This gap enables the attacker to present spoofed data, links, or identities to other users of the SharePoint deployment.

Attack Vector

Exploitation occurs over the network against an exposed SharePoint Server endpoint. The attacker authenticates using any valid low-privilege account, then issues requests that abuse the missing access control checks. The resulting spoofed content can be used to trick administrators or peers into trusting attacker-controlled resources within an otherwise legitimate SharePoint site.

No public proof-of-concept or exploit code has been published for CVE-2026-56157 at the time of writing. See the Microsoft Security Update CVE-2026-56157 advisory for vendor-provided technical detail.

Detection Methods for CVE-2026-56157

Indicators of Compromise

Unexpected modifications to SharePoint list items, pages, or document metadata performed by low-privileged accounts.
SharePoint audit log entries showing access to resources outside a user's normal site collection or permission scope.
User reports of SharePoint content, links, or sender identities that appear legitimate but lead to unexpected destinations.

Detection Strategies

Enable and review SharePoint auditing for permission changes, item edits, and access attempts on sensitive libraries.
Correlate authentication events with SharePoint object access to identify low-privilege accounts touching high-value content.
Baseline normal user behavior in SharePoint and alert on deviations such as unusual API call patterns or bulk metadata changes.

Monitoring Recommendations

Forward SharePoint ULS logs and IIS access logs to a centralized SIEM for retention and correlation.
Monitor the /_api/ and /_vti_bin/ endpoints for anomalous request patterns from authenticated users.
Track the installation state of the July 2026 Microsoft security updates across all SharePoint farms to confirm patch coverage.

How to Mitigate CVE-2026-56157

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-56157 to all affected SharePoint Server instances.
Inventory SharePoint Server 2016, 2019, and Subscription Edition deployments and prioritize internet-exposed farms.
Review recent SharePoint audit logs for suspicious low-privilege activity prior to patching.

Patch Information

Microsoft has published a security update through the Microsoft Security Response Center. Administrators should consult the Microsoft Security Update CVE-2026-56157 advisory for the specific KB numbers and installation guidance corresponding to each supported SharePoint Server version.

Workarounds

Restrict network access to SharePoint Server management endpoints using firewall rules or reverse proxy allow-lists.
Enforce least-privilege permissions across SharePoint sites and remove unnecessary contributor or member access.
Require multi-factor authentication for all SharePoint users to raise the cost of obtaining the low-privilege access needed to exploit this flaw.

bash

# Example: list installed SharePoint updates on a server
Get-HotFix | Where-Object { $_.Description -like '*SharePoint*' } | Sort-Object InstalledOn -Descending