CVE-2026-56164 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-07-14

Added to CISA KEV: 2026-07-14 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review IIS/SharePoint logs, check for unauthorized Farm Administrator additions, unexpected web shells (.aspx), anomalous authentication events, and verify system integrity immediately.
PATCH IMMEDIATELY: Apply the Microsoft security updates per the MSRC advisory — SharePoint Subscription Edition >= 16.0.19725.20434, SharePoint 2019 >= 16.0.10417.20175, SharePoint 2016 >= 16.0.5561.1001. Rotate machine keys and credentials after patching given active exploitation.
Follow CISA SharePoint hardening guidance; restrict internet exposure of on-prem SharePoint via reverse proxy/WAF, enable AMSI integration, and deploy vendor IPS signatures.
Patch priority: EMERGENCY / P0 — actively exploited, unauthenticated, network-accessible, on internet-facing servers with PoC available.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-56164 is a critical security vulnerability affecting on-premises Microsoft SharePoint Server, classified under CWE-306 as a missing authentication for a critical function. The flaw allows an unauthenticated, remote attacker to bypass identity verification controls and perform unauthorized actions, potentially leading to elevation of privileges up to the Farm Administrator level. This vulnerability is highly significant due to its potential for full system compromise and its inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog.

Exploitation

Active Exploitation: The vulnerability is actively exploited in the wild, with CISA issuing alerts regarding its use by threat actors to gain unauthorized access to on-premises SharePoint instances ^[1].
Threat Actors: While specific named ransomware campaigns have not been exclusively linked to this single CVE, it is part of a cluster of vulnerabilities being leveraged by advanced cyber threat actors to compromise SharePoint infrastructure ^[1].
Proof-of-Concept: Publicly available proof-of-concept (PoC) exploit code exists, such as the repository maintained by `sam00` on GitHub ^[4].
Attack Prerequisites: The attack is remote (network-based) and does not require local access. It does not require prior authentication or user interaction to succeed ^[2].

Affected Products & Patches

Affected Products: On-premises versions of Microsoft SharePoint Server are affected ^[2].
Patch/Hotfix: Microsoft has released security updates to address this vulnerability; administrators should consult the Microsoft Security Response Center (MSRC) update guide to verify and apply the latest patches ^[3].
Mitigations: In addition to applying official patches, organizations are urged to follow CISA’s SharePoint hardening guidance to secure their instances against unauthorized access attempts ^[1].

Impact

Capability: Successful exploitation provides attackers with the ability to bypass identity verification, resulting in privilege escalation up to Farm Administrator level, and potentially remote code execution ^[2]^[5].
Business Risk: For internet-facing deployments, this vulnerability presents an extreme risk, as it allows external actors to take full control of the SharePoint environment without needing credentials, potentially leading to data breaches, lateral movement within the network, and complete system compromise.

Sources

CISA Urges SharePoint Hardening After New Exploitations
CISA is aware of active exploitation of vulnerabilities CVE-2026-32201 , CVE-2026-45659 , CVE-2026-56164 , CVE-2026-58644 , CVE-2026-50522 , and CVE-2026-55040 , enabling cyber threat actors to gain unauthorized access to on-premises SharePoint Server instances.
CVE-2026-56164: CVE-2026-56164: Elevation of Privilege via Missing ...
CVE-2026-56164 is a critical vulnerability affecting Microsoft SharePoint Server. It permits unauthenticated, remote attackers to bypass identity verification controls. This flaw is classified under CWE-306: Missing Authentication for Critical Function and allows elevation of privilege up to Farm Ad…
CVE-2026-56164
Security Update Guide - Microsoft Security Response Center You need to enable JavaScript to run this app.
sam00/POC-CVE-2026-56164-exploit
CVE-2026-56164 is a critical missing-authentication vulnerability affecting on-premises Microsoft SharePoint Server.
CVE-2026-56164 - IPS Signatures
HTTP: Microsoft SharePoint Server CVE-2026-56164 Remote Code Execution. This signature detects attempts to exploit a known vulnerability against Microsoft ...

🔴 CVE-2026-56164