CVE-2026-56164
Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability
Description
CVE-2026-56164 is a missing authentication vulnerability in Microsoft SharePoint Server that allows an unauthorized attacker to elevate privileges over a network. The flaw means SharePoint exposes functionality that should require a provable user identity without any authentication check, so a remote attacker needs no credentials and no user interaction to abuse it. While the CVSS 3.1 score of 5.3 rates CVE-2026-56164 as Medium with a low integrity impact, its real-world relevance is high: CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation, and its EPSS score in the 92nd percentile signals elevated exploitation likelihood. Organizations running affected SharePoint Server builds, including SharePoint Server 2016 and 2019, should apply Microsoft's security update promptly.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | sharepoint server | < 16.0.19725.20434; 2016; 2019 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56164(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
Missing authentication for a critical function occurs when software performs no authentication at all for functionality that requires a provable user identity — not weak authentication, but its complete absence. In Microsoft SharePoint Server, this weakness exposes a function over the network that should be restricted, allowing an unauthenticated attacker to invoke it and elevate privileges without presenting any credentials.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2026-56164 carries a CVSS 3.1 score of 5.3 (Medium) and is remotely exploitable without physical access, easy to exploit with no special conditions, requires no authentication, and needs no user action — a combination that makes opportunistic scanning and exploitation straightforward against internet-facing SharePoint servers. The direct technical impact is limited to a low integrity impact: an attacker can modify some data or system behavior, while confidentiality and availability are not directly affected and the scope remains unchanged. The description notes that the missing authentication enables privilege elevation, which can serve as a stepping stone within a larger attack chain against a SharePoint environment. Despite the moderate score, the risk picture is sharpened by two facts: CISA has confirmed active exploitation in the wild through its KEV listing, and the EPSS score of 5.6% places this vulnerability in the 92nd percentile, meaning it is more likely to be exploited than the vast majority of published CVEs.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-56164 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with a remediation due date of 2026-07-17 that has already passed; ransomware usage is currently unknown. No public exploit code or proof-of-concept is referenced in the available sources, which comprise the Microsoft MSRC advisory and the CISA KEV entry. The EPSS score of 5.6% places the vulnerability in the 92nd percentile, indicating a substantially elevated exploitation likelihood compared to most CVEs. Taken together — confirmed in-the-wild attacks, high EPSS percentile, and an unauthenticated network attack path — organizations should treat unpatched SharePoint servers as an immediate action item.
Remediation
- Follow the CISA KEV required action: apply mitigations in accordance with Microsoft's instructions, ensuring compliance with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and CISA's Forensics Triage Requirements; discontinue use if mitigations are unavailable. The KEV remediation due date was 2026-07-17, so remediation is already overdue for organizations subject to the directive.
- Install the Microsoft security update referenced in the MSRC advisory for CVE-2026-56164. Affected products are SharePoint Server builds before 16.0.19725.20434 as well as SharePoint Server 2016 and 2019 — update all farm servers to the fixed build level.
- As an interim mitigation, reduce network exposure of SharePoint: avoid direct internet exposure where possible, place SharePoint behind a reverse proxy or VPN, and restrict access to the affected endpoints to authenticated, trusted networks.
- Review SharePoint and IIS logs for unauthenticated requests to privileged functionality and for unexpected privilege or permission changes, especially given the confirmed active exploitation; perform forensic triage on suspicious systems in line with CISA guidance.
- As long-term hardening against CWE-306-class issues, ensure authentication is enforced at the API and service layer for every critical function — never rely on obscurity or UI-level restrictions to protect administrative or privileged SharePoint operations.
Technical Details
The root cause of CVE-2026-56164 is a missing authentication check (CWE-306) on a critical function in Microsoft Office SharePoint: the affected functionality requires a provable user identity but performs no authentication whatsoever, so any remote party that can reach the endpoint can invoke it. According to the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the attack proceeds over the network with low complexity, requires neither privileges nor user interaction, and yields a low integrity impact within an unchanged scope — the attacker can leverage the unauthenticated function to elevate privileges and effect limited modifications. This is the complete-absence form of the weakness rather than a bypass of weak authentication, which is what makes exploitation trivial once the vulnerable endpoint is reachable; network reachability of the SharePoint server is therefore the primary precondition for attack.
Frequently Asked Questions
Is CVE-2026-56164 being actively exploited?
Yes. CISA has added CVE-2026-56164 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and the remediation due date of 2026-07-17 has already passed. The EPSS score of 5.6% puts it in the 92nd percentile, indicating a high likelihood of exploitation; ransomware usage is currently unknown.
What products are affected by CVE-2026-56164?
The vulnerability affects Microsoft SharePoint Server. Affected versions include SharePoint Server builds prior to 16.0.19725.20434 as well as SharePoint Server 2016 and SharePoint Server 2019.
How do I fix CVE-2026-56164?
Install the Microsoft security update referenced in the MSRC advisory for CVE-2026-56164 on all SharePoint farm servers, bringing them to build 16.0.19725.20434 or later where applicable. Until patched, limit network exposure of SharePoint endpoints and monitor logs for unauthenticated access to privileged functionality.
How severe is CVE-2026-56164?
CVE-2026-56164 is rated Medium with a CVSS 3.1 score of 5.3, reflecting a low direct integrity impact. However, it is exploitable remotely without authentication or user interaction, is confirmed as actively exploited by CISA, and its EPSS score sits in the 92nd percentile — so its practical urgency is significantly higher than the numeric score suggests.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.