~/f4n6 $ grep -r "CVE-2026-56164 — Microsoft SharePoint Server: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability" ./investigations/ --include="*.md"

CVE-2026-56164 — Microsoft SharePoint Server: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability

Jeff Davies 14 Jul 2026 6 min read

1. Executive summary

CVE-2026-56164 is a Missing Authentication for Critical Function vulnerability (CVSS 5.3 MEDIUM) in Microsoft SharePoint Server that allows an unauthorized attacker to elevate privileges over a network. The vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2026-07-14, confirming active exploitation in the wild. EMEA financial services organisations running internet-facing SharePoint Server instances are at immediate risk of privilege escalation by unauthenticated attackers. A separate but related SharePoint vulnerability (CVE-2026-45659, deserialization of untrusted data, CVSS 8.8) is also in the CISA KEV catalog and may be chained by threat actors to achieve remote code execution post-elevation.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 17: ICT-related incident management process Active exploitation of a KEV-listed vulnerability in SharePoint Server, a critical collaboration platform Financial entities must ensure their ICT incident management process can detect and respond to exploitation attempts against this vulnerability.
DORA Art. 18: classification of ICT-related incidents and cyber threats CISA KEV confirmation of in-the-wild exploitation constitutes a identified cyber threat Incidents involving this CVE must be classified according to the entity's taxonomy, potentially meeting major-incident thresholds if privilege escalation is successful.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities Successful exploitation resulting in privilege escalation on SharePoint infrastructure If exploitation leads to a major ICT-related incident, financial entities must report to competent authorities within prescribed timelines.
DORA Art. 24: digital operational resilience testing — general requirements Vulnerability exists in production SharePoint deployments Entities must verify that vulnerability scanning and patch management programmes cover SharePoint Server and that remediation is tested.
NIS2 Art. 21(2)(d): supply chain security measures Microsoft SharePoint Server is a third-party ICT product with an actively exploited vulnerability In-scope organisations must ensure supply chain security measures address vendor vulnerability disclosure and patching timelines.
NIS2 Art. 23: incident reporting obligations Active exploitation confirmed via CISA KEV NIS2 in-scope organisations experiencing exploitation must meet incident notification obligations to national CSIRTs.
UK NIS 2018: UK Network and Information Systems Regulations — OES/RDSP duties Active exploitation of infrastructure software UK OES and RDSP operators should assess whether SharePoint exploitation constitutes a reportable incident under their regulatory duties.

3. Technical analysis & attack chain

Vulnerability details

  • CVE: CVE-2026-56164
  • CVSS: 5.3 (MEDIUM) — per verified NVD data
  • CWE: CWE-306 (Missing Authentication for Critical Function)
  • CISA KEV: Yes — added 2026-07-14
  • CISA KEV remediation due date: 2026-07-17
  • Known ransomware campaign use: Unknown
  • Affected product: Microsoft SharePoint Server
  • Attack vector: Network-based, unauthenticated

Attack chain (confirmed steps)

  1. Reconnaissance: The attacker identifies an exposed Microsoft SharePoint Server instance accessible over the network. The vulnerability requires no authentication, making internet-facing SharePoint deployments the primary target.
  2. Initial exploitation: The attacker accesses a critical SharePoint Server function that is missing authentication controls. The specific function and endpoint are not detailed in the available source material. The attacker interacts with this function over the network without supplying valid credentials.
  3. Privilege escalation: Successful exploitation of the missing authentication flaw allows the attacker to elevate privileges on the SharePoint Server. The NVD description states the attacker can "elevate privileges over a network."
  4. Post-exploitation (potential chaining): With elevated privileges, the attacker may pivot to exploiting CVE-2026-45659 (deserialization of untrusted data, CVSS 8.8), a separate SharePoint Server vulnerability also in the CISA KEV catalog. CVE-2026-45659 requires an authenticated attacker to execute code remotely — the privilege escalation from CVE-2026-56164 could satisfy that authentication precondition. This chaining scenario is an analytical assessment by Adverse Trace; it is not explicitly confirmed in the source material.

CVE-2026-45659 (corpus references 1–6) is a deserialization of untrusted data vulnerability in Microsoft SharePoint Server with a CVSS score of 8.8. It was added to CISA KEV with a remediation due date of 2026-07-04 and affects:

  • SharePoint Server Subscription Edition
  • SharePoint Server 2019
  • SharePoint Enterprise Server 2016

CVE-2026-45659 allows an authenticated attacker to execute code remotely with low attack complexity and no user interaction required. CISA has confirmed active exploitation of this vulnerability. The GitHub Security Advisory (GHSA-qhm9-9gfp-672c) describes an "improper authorization" issue in Microsoft Office SharePoint allowing an authorized attacker to elevate privileges over a network — this may overlap with or relate to CVE-2026-56164, though the exact relationship is not confirmed in the source material.

Confidence caveats

  • The specific vulnerable SharePoint function, endpoint, or component exploited in CVE-2026-56164 is not detailed in the available source material. The attack chain above is based on the NVD description and CISA KEV entry only.
  • No threat actor attribution is present in the source material. No MITRE ATT&CK actor profile is available. Attribution is unconfirmed.
  • The potential chaining of CVE-2026-56164 with CVE-2026-45659 is a single-sourced analytical assessment by Adverse Trace based on the logical relationship between the two vulnerabilities; verify before enforcement.
  • No IOCs, malware families, command-and-control infrastructure, or persistence mechanisms are described in the source material for either CVE.

4. Mitigation & containment

P1 — Within 24 hours

  1. Inventory and exposure assessment: Identify all Microsoft SharePoint Server instances in the estate. Flag any that are internet-facing or accessible from untrusted network segments. Prioritise these for immediate remediation.
  2. Apply vendor patches: Apply Microsoft security updates for SharePoint Server in accordance with vendor instructions. The CISA KEV entry mandates remediation by 2026-07-17. If patches are not yet available or cannot be deployed in time, proceed to containment steps below.
  3. Network containment: Restrict access to SharePoint Server instances to authenticated internal users only. Block inbound access from the internet to SharePoint Server administration interfaces and any critical function endpoints. Enforce VPN or zero-trust network access for remote users.
  4. EDR / SIEM monitoring: Increase monitoring on SharePoint Server hosts for anomalous privilege escalation events, unexpected process creation, and unusual service account activity. Alert on: - Unexpected SharePoint timer service (OWSTIMER.EXE) child processes - Application pool account (IIS AppPool) spawning unexpected processes - New local account creation on SharePoint servers - Unexpected IIS worker process (w3wp.exe) command-line execution

P2 — Within 72 hours

  1. Authentication hardening: Review and enforce strong authentication on all SharePoint Server endpoints. Ensure that critical administrative functions require explicit authentication and are not exposed to unauthenticated network access. Verify IIS authentication settings (Windows Authentication, Anonymous Authentication) on all SharePoint web applications.
  2. Patch CVE-2026-45659 concurrently: If not already remediated, apply Microsoft patches for CVE-2026-45659 (CISA KEV due date 2026-07-04 has passed). This eliminates the potential RCE chaining path. Affected versions: SharePoint Server Subscription Edition, SharePoint Server 2019, SharePoint Enterprise Server 2016.
  3. Forensic triage: Conduct forensic triage on SharePoint Server instances that were internet-facing or exposed to untrusted networks prior to patching. Look for evidence of privilege escalation, unexpected account creation, or anomalous IIS worker process behaviour. CISA's BOD 26-04 "Forensics Triage Requirements" guidance applies.

P3 — Within 7 days

  1. Architecture review: Evaluate whether SharePoint Server administration interfaces and critical functions need to be exposed on the corporate network at all. Move administration behind jump hosts with MFA. Implement network segmentation to isolate SharePoint Server tiers.
  2. Vulnerability management validation: Confirm that the organisation's vulnerability scanning programme covers all SharePoint Server versions and that scan results are correlated with CISA KEV additions within 24 hours of KEV publication.
  3. Third-party risk notification: If SharePoint Server is managed by an ICT third-party service provider, notify the provider of the KEV listing and confirm remediation status. This engages DORA Art. 28 (ICT third-party risk — general principles) and DORA Art. 30 (key contractual provisions with ICT third-party providers).

5. Indicators of compromise

No indicators of compromise available in the source material.

6. Detection

Insufficient indicators to author detection rules.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

CVE CVSS Exploited EPSS Summary
CVE-2026-56164 5.3 Medium ⚠ KEV 2026-07-14 — Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileg…

7. Sources

  • NVD, CVE-2026-56164 — Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-56164, published 2026-07-13
  • CISA Known Exploited Vulnerabilities catalog (CVE-2026-56164 entry, added 2026-07-14)
  • NVD, CVE-2026-45659 — Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-45659
  • GitHub Security Advisories, GHSA-qhm9-9gfp-672c — Improper authorization in Microsoft Office SharePoint, https://github.com/advisories/GHSA-qhm9-9gfp-672c
  • SecurityWeek, CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability, https://www.securityweek.com/cisa-warns-of-actively-exploited-sharepoint-vulnerability/
  • The Hacker News, SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation, https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html
  • Help Net Security, High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659), https://www.helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659/
  • The Hacker News, Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions, https://thehackernews.com/2026/05/microsoft-patches-sharepoint-rce-flaw.html

8. Adverse Trace position

CVE-2026-56164 is a confirmed MEDIUM-severity (CVSS 5.3) missing authentication vulnerability in Microsoft SharePoint Server with active exploitation confirmed by its inclusion in the CISA KEV catalog as of 2026-07-14. The CISA remediation deadline of 2026-07-17 gives affected organisations a three-day window. While the CVSS score is moderate, the practical risk is elevated for EMEA financial services clients because: (a) SharePoint Server is widely deployed in financial sector collaboration and document management workflows; (b) the vulnerability requires no authentication, making internet-facing instances immediately exploitable; and (c) the potential to chain with CVE-2026-45659 (CVSS 8.8, RCE, also actively exploited) could enable full remote code execution on SharePoint infrastructure. No threat actor attribution or IOCs are available in the source material — attribution is unconfirmed and detection capabilities are limited. Adverse Trace will monitor for emerging IOC disclosures, threat actor attribution, and any Microsoft guidance specific to CVE-2026-56164 and will issue an updated advisory if significant new information emerges. Clients should prioritise patching internet-facing SharePoint Server instances immediately and conduct forensic triage on any systems that were exposed prior to remediation.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies