CVE-2026-56164: SharePoint Server Privilege Escalation Flaw

CVE-2026-56164 Overview

CVE-2026-56164 is a missing authentication vulnerability in Microsoft Office SharePoint Server. An unauthenticated remote attacker can invoke a critical server function over the network and elevate privileges without any user interaction. The weakness maps to [CWE-306: Missing Authentication for Critical Function]. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, confirming active exploitation against SharePoint deployments.

Critical Impact
Unauthenticated attackers can escalate privileges over the network against exposed SharePoint Server instances, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 (Enterprise)

Discovery Timeline

2026-07-14 - CVE-2026-56164 published to the National Vulnerability Database
2026-07-14 - Last updated in NVD database
2026-07-14 - Microsoft Security Response Center advisory published
2026-07-14 - Added to CISA Known Exploited Vulnerabilities catalog

Technical Details for CVE-2026-56164

Vulnerability Analysis

The vulnerability resides in a SharePoint Server endpoint that performs a security-relevant operation without validating the caller. Because authentication is not enforced on this critical function, an attacker who can reach the SharePoint web tier can invoke it directly. The result is privilege elevation within the SharePoint application context. Post-exploitation activity typically includes extracting machine keys, forging trusted payloads, and pivoting into connected identity and content services. Public reporting linked to the CISA KEV entry indicates the flaw is being weaponized against internet-facing SharePoint farms.

Root Cause

The root cause is a missing authentication check ([CWE-306]) on a request handler that performs sensitive server-side actions. The handler assumes an authenticated context but does not enforce it. This design gap allows anonymous HTTP requests to reach code paths intended only for privileged users. The condition affects on-premises SharePoint Server 2016, 2019, and Subscription Edition builds prior to the July 2026 security update.

Attack Vector

Exploitation occurs over the network against the SharePoint HTTP(S) endpoint. The attacker requires no credentials, no prior foothold, and no user interaction. Any SharePoint Server reachable from the attacker — including externally exposed farms and internal servers reachable through a compromised host — is a valid target. Successful exploitation grants privileged execution within SharePoint, which attackers commonly chain with ViewState deserialization or web shell deployment to achieve remote code execution and persistence. Refer to the Microsoft CVE-2026-56164 Advisory for the vendor's technical details.

Detection Methods for CVE-2026-56164

Indicators of Compromise

Anonymous HTTP POST requests to SharePoint endpoints under /_layouts/15/ or /_vti_bin/ from unexpected external IP addresses.
Creation of unfamiliar .aspx files in the SharePoint LAYOUTS directory or the site's wwwroot, often with randomized filenames.
w3wp.exe spawning cmd.exe, powershell.exe, or csc.exe on SharePoint servers.
Extraction attempts targeting MachineKey values from web.config files.

Detection Strategies

Hunt IIS logs for unauthenticated requests to SharePoint handlers that return HTTP 200 with unusually large or binary responses.
Alert on child processes of w3wp.exe associated with the SharePoint application pool identity.
Monitor for outbound connections from SharePoint servers to non-corporate destinations shortly after inbound requests to /_layouts/.

Monitoring Recommendations

Forward IIS, Windows Security, and Sysmon logs from all SharePoint front-end and application servers to a centralized SIEM.
Baseline expected SharePoint request patterns and flag deviations in URI, User-Agent, and request body size.
Track the CISA KEV catalog and Microsoft advisory pages for updated indicators tied to CVE-2026-56164.

How to Mitigate CVE-2026-56164

Immediate Actions Required

Apply the July 2026 Microsoft security updates for SharePoint Server 2016, 2019, and Subscription Edition without delay.
Rotate SharePoint machine keys after patching, as key material may have been exposed during exploitation.
Restrict inbound access to SharePoint web front-ends so only trusted networks or authenticated reverse proxies can reach them.
Investigate for prior compromise on any SharePoint server that was internet-exposed before patching.

Patch Information

Microsoft has released fixed builds for all supported SharePoint Server versions. Consult the Microsoft CVE-2026-56164 Advisory for the exact KB numbers, cumulative update packages, and post-installation steps. Because SharePoint is listed in the CISA Known Exploited Vulnerabilities catalog, U.S. federal agencies must remediate within the BOD 22-01 timeline.

Workarounds

Enable Antimalware Scan Interface (AMSI) integration in full mode for SharePoint and ensure Microsoft Defender Antivirus is active on all SharePoint servers.
Place SharePoint behind a reverse proxy or Web Application Firewall that enforces authentication before requests reach the server.
Disconnect internet-facing SharePoint servers that cannot be patched immediately until the update is applied.

bash

# Rotate SharePoint machine keys after patching (run on a SharePoint server)
Set-SPMachineKey -WebApplication https://sharepoint.contoso.com
IISReset