Threat Intelligence / CVE / CVE-2026-56164

CVE-2026-56164 — Microsoft SharePoint Enterprise Server 2016

CISA KEV

CVSS v3.1 5.3 (MEDIUM) · Priority 9/10 · Published 2026-07-14

As of 2026-07-14, CVE-2026-56164 is a MEDIUM-severity vulnerability in Microsoft SharePoint Enterprise Server 2016, CVSS v3.1 5.3. It is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-07-14), with a US federal remediation deadline of 2026-07-17. Threadlinqs Intelligence links 21 tracked threat campaigns to CVE-2026-56164, most recently “Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days (CVE-2026-56155 AD FS, CVE-2026-56164 SharePoint) Among Record 570+ Fixes”.

Last updated: 2026-07-14

What is CVE-2026-56164?

Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

The record classifies CVE-2026-56164 under weakness class CWE-306. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction. 3 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 60 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 5.3 — MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C
CISA KEV: Listed since 2026-07-14, federal remediation deadline 2026-07-17
Threadlinqs priority: 9/10 — CISA KEV-listed, which Threadlinqs floors at 9
Published: 2026-07-14

Is CVE-2026-56164 being exploited?

CISA added CVE-2026-56164 to the Known Exploited Vulnerabilities catalog on 2026-07-14, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2026-07-17 under BOD 22-01. It currently carries a trending score of 40 in the Threadlinqs vulnerability feed.

Affected products and versions

Microsoft: SharePoint Enterprise Server 2016, SharePoint Server 2019, SharePoint Server Subscription Edition

How to fix CVE-2026-56164

Because CVE-2026-56164 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2026-07-17. No vendor patch reference has been recorded for CVE-2026-56164 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2026-56164

21 tracked threats in the Threadlinqs corpus reference CVE-2026-56164, either in the campaign’s CVE list or as an indicator on the campaign record.

Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days (CVE-2026-56155 AD FS, CVE-2026-56164 SharePoint) Among Record 570+ Fixes — HIGH · 2026-07-17
CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV Catalog — CRITICAL · 2026-07-17
July 2026 Patch Tuesday: Actively Exploited SharePoint RCE (CVE-2026-58644) and AD FS/SharePoint Zero-Days — CRITICAL · 2026-07-17
Actively Exploited SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410) Chained for Full Appliance Takeover Alongside Microsoft July 2026 Patch Tuesday (570 CVEs, 3 Zero-Days incl. SharePoint & AD FS EoP) — CRITICAL · 2026-07-17
CVE-2026-58644: Microsoft SharePoint Server Unauthenticated Remote Code Execution Exploited in the Wild — CRITICAL · 2026-07-17
CVE-2026-50661: Windows BitLocker Security Feature Bypass 0-Day — MEDIUM · 2026-07-15
Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days in AD FS (CVE-2026-56155) and SharePoint (CVE-2026-56164), Plus Unpatched BitLocker Bypass (CVE-2026-50661) — CRITICAL · 2026-07-15
CISA Warns of Active Exploitation of Three Microsoft SharePoint Server Vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) — CRITICAL · 2026-07-15
Actively Exploited SharePoint Server Elevation of Privilege Flaw (CVE-2026-56164) Patched Alongside Critical RCE Pair in July 2026 Patch Tuesday — CRITICAL · 2026-07-15
CVE-2026-56164: Microsoft SharePoint Server Missing-Authentication Vulnerability Actively Exploited, Added to CISA KEV — CRITICAL · 2026-07-15
July 2026 Patch Tuesday: Microsoft Fixes 622 CVEs Including Three Actively-Targeted Zero-Days (CVE-2026-56155 AD FS EoP, CVE-2026-56164 SharePoint EoP, CVE-2026-50661 BitLocker Bypass) — CRITICAL · 2026-07-15
CISA Warns of Trio of Actively Exploited SharePoint Server Flaws (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164) — CRITICAL · 2026-07-15
Microsoft July 2026 Patch Tuesday: 570 Flaws Fixed, 3 Zero-Days Including AD FS and SharePoint Privilege Escalation — CRITICAL · 2026-07-14
Microsoft July 2026 Patch Tuesday: 570 Vulnerabilities Fixed, Including 2 Actively Exploited Zero-Days (CVE-2026-56164, CVE-2026-56155) — CRITICAL · 2026-07-14
Windows 10 KB5099539 Extended Security Update Patches July 2026 Patch Tuesday Zero-Days — AD FS (CVE-2026-56155), SharePoint (CVE-2026-56164) Exploited; BitLocker (CVE-2026-50661) Publicly Disclosed — HIGH · 2026-07-14
Microsoft July 2026 Patch Tuesday: 569 CVEs, Two Actively Exploited Zero-Days (CVE-2026-56155 AD FS EoP, CVE-2026-56164 SharePoint EoP) — CRITICAL · 2026-07-14
Microsoft July 2026 Patch Tuesday: 570 Vulnerabilities Including Two Under Active Exploitation (CVE-2026-56155, CVE-2026-56164) — HIGH · 2026-07-14
Microsoft July 2026 Patch Tuesday: Record 622 CVEs Include Two Actively Exploited Zero-Days in AD FS (CVE-2026-56155) and SharePoint Server (CVE-2026-56164) — CRITICAL · 2026-07-14
Microsoft July 2026 Patch Tuesday: Record 622 Flaws Fixed, Two Zero-Days Under Active Exploitation (CVE-2026-56164, CVE-2026-56155) — CRITICAL · 2026-07-14
Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days in AD FS and SharePoint (CVE-2026-56155, CVE-2026-56164) — CRITICAL · 2026-07-14
July 2026 Patch Tuesday: Two Actively Exploited Microsoft Zero-Days (SharePoint EoP CVE-2026-56164, AD FS EoP CVE-2026-56155) Plus SharePoint JWT Auth Bypass CVE-2026-55040 — HIGH · 2026-07-14

Sources

Enriched from CVE.org, NVD, CISA KEV, GitHub Security Advisories. Last verified by Threadlinqs on 2026-07-14. This product uses the NVD API but is not endorsed or certified by the NVD.

Vendor advisory and patch

msrc.microsoft.com — vendor advisory

Full detection coverage & IOCs for threats exploiting CVE-2026-56164 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence