# CVE-2026-56164 — Microsoft SharePoint Enterprise Server 2016 **CISA KEV** > As of 2026-07-14, CVE-2026-56164 is a MEDIUM-severity vulnerability in Microsoft SharePoint Enterprise Server 2016, CVSS v3.1 5.3. It is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-07-14), with a US federal remediation deadline of 2026-07-17. Threadlinqs Intelligence links 21 tracked threat campaigns to CVE-2026-56164, most recently “Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days (CVE-2026-56155 AD FS, CVE-2026-56164 SharePoint) Among Record 570+ Fixes”. **Last updated:** 2026-07-14 ## What is CVE-2026-56164? Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. The record classifies CVE-2026-56164 under weakness class [CWE-306](https://cwe.mitre.org/data/definitions/306.html). Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction. 3 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 60 days ago. ## Severity and exploitation probability - **CVSS v3.1 base score:** 5.3 — MEDIUM (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C`) - **CISA KEV:** Listed since 2026-07-14, federal remediation deadline 2026-07-17 - **Threadlinqs priority:** 9/10 — CISA KEV-listed, which Threadlinqs floors at 9 - **Published:** 2026-07-14 ## Is CVE-2026-56164 being exploited? CISA added CVE-2026-56164 to the Known Exploited Vulnerabilities catalog on 2026-07-14, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2026-07-17 under BOD 22-01. It currently carries a trending score of 40 in the Threadlinqs vulnerability feed. ## Affected products and versions - **Microsoft**: SharePoint Enterprise Server 2016, SharePoint Server 2019, SharePoint Server Subscription Edition ## How to fix CVE-2026-56164 Because CVE-2026-56164 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2026-07-17. No vendor patch reference has been recorded for CVE-2026-56164 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise. ## Threat activity tracking CVE-2026-56164 21 tracked threats in the Threadlinqs corpus reference CVE-2026-56164, either in the campaign’s CVE list or as an indicator on the campaign record. - [Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days (CVE-2026-56155 AD FS, CVE-2026-56164 SharePoint) Among Record 570+ Fixes](https://intel.threadlinqs.com/threat/TL-2026-1430) — HIGH · 2026-07-17 - [CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV Catalog](https://intel.threadlinqs.com/threat/TL-2026-1434) — CRITICAL · 2026-07-17 - [July 2026 Patch Tuesday: Actively Exploited SharePoint RCE (CVE-2026-58644) and AD FS/SharePoint Zero-Days](https://intel.threadlinqs.com/threat/TL-2026-1437) — CRITICAL · 2026-07-17 - [Actively Exploited SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410) Chained for Full Appliance Takeover Alongside Microsoft July 2026 Patch Tuesday (570 CVEs, 3 Zero-Days incl. SharePoint & AD FS EoP)](https://intel.threadlinqs.com/threat/TL-2026-1451) — CRITICAL · 2026-07-17 - [CVE-2026-58644: Microsoft SharePoint Server Unauthenticated Remote Code Execution Exploited in the Wild](https://intel.threadlinqs.com/threat/TL-2026-1460) — CRITICAL · 2026-07-17 - [CVE-2026-50661: Windows BitLocker Security Feature Bypass 0-Day](https://intel.threadlinqs.com/threat/TL-2026-1346) — MEDIUM · 2026-07-15 - [Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days in AD FS (CVE-2026-56155) and SharePoint (CVE-2026-56164), Plus Unpatched BitLocker Bypass (CVE-2026-50661)](https://intel.threadlinqs.com/threat/TL-2026-1350) — CRITICAL · 2026-07-15 - [CISA Warns of Active Exploitation of Three Microsoft SharePoint Server Vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164)](https://intel.threadlinqs.com/threat/TL-2026-1361) — CRITICAL · 2026-07-15 - [Actively Exploited SharePoint Server Elevation of Privilege Flaw (CVE-2026-56164) Patched Alongside Critical RCE Pair in July 2026 Patch Tuesday](https://intel.threadlinqs.com/threat/TL-2026-1364) — CRITICAL · 2026-07-15 - [CVE-2026-56164: Microsoft SharePoint Server Missing-Authentication Vulnerability Actively Exploited, Added to CISA KEV](https://intel.threadlinqs.com/threat/TL-2026-1369) — CRITICAL · 2026-07-15 - [July 2026 Patch Tuesday: Microsoft Fixes 622 CVEs Including Three Actively-Targeted Zero-Days (CVE-2026-56155 AD FS EoP, CVE-2026-56164 SharePoint EoP, CVE-2026-50661 BitLocker Bypass)](https://intel.threadlinqs.com/threat/TL-2026-1372) — CRITICAL · 2026-07-15 - [CISA Warns of Trio of Actively Exploited SharePoint Server Flaws (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164)](https://intel.threadlinqs.com/threat/TL-2026-1378) — CRITICAL · 2026-07-15 - [Microsoft July 2026 Patch Tuesday: 570 Flaws Fixed, 3 Zero-Days Including AD FS and SharePoint Privilege Escalation](https://intel.threadlinqs.com/threat/TL-2026-1324) — CRITICAL · 2026-07-14 - [Microsoft July 2026 Patch Tuesday: 570 Vulnerabilities Fixed, Including 2 Actively Exploited Zero-Days (CVE-2026-56164, CVE-2026-56155)](https://intel.threadlinqs.com/threat/TL-2026-1325) — CRITICAL · 2026-07-14 - [Windows 10 KB5099539 Extended Security Update Patches July 2026 Patch Tuesday Zero-Days — AD FS (CVE-2026-56155), SharePoint (CVE-2026-56164) Exploited; BitLocker (CVE-2026-50661) Publicly Disclosed](https://intel.threadlinqs.com/threat/TL-2026-1326) — HIGH · 2026-07-14 - [Microsoft July 2026 Patch Tuesday: 569 CVEs, Two Actively Exploited Zero-Days (CVE-2026-56155 AD FS EoP, CVE-2026-56164 SharePoint EoP)](https://intel.threadlinqs.com/threat/TL-2026-1327) — CRITICAL · 2026-07-14 - [Microsoft July 2026 Patch Tuesday: 570 Vulnerabilities Including Two Under Active Exploitation (CVE-2026-56155, CVE-2026-56164)](https://intel.threadlinqs.com/threat/TL-2026-1330) — HIGH · 2026-07-14 - [Microsoft July 2026 Patch Tuesday: Record 622 CVEs Include Two Actively Exploited Zero-Days in AD FS (CVE-2026-56155) and SharePoint Server (CVE-2026-56164)](https://intel.threadlinqs.com/threat/TL-2026-1331) — CRITICAL · 2026-07-14 - [Microsoft July 2026 Patch Tuesday: Record 622 Flaws Fixed, Two Zero-Days Under Active Exploitation (CVE-2026-56164, CVE-2026-56155)](https://intel.threadlinqs.com/threat/TL-2026-1334) — CRITICAL · 2026-07-14 - [Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days in AD FS and SharePoint (CVE-2026-56155, CVE-2026-56164)](https://intel.threadlinqs.com/threat/TL-2026-1336) — CRITICAL · 2026-07-14 - [July 2026 Patch Tuesday: Two Actively Exploited Microsoft Zero-Days (SharePoint EoP CVE-2026-56164, AD FS EoP CVE-2026-56155) Plus SharePoint JWT Auth Bypass CVE-2026-55040](https://intel.threadlinqs.com/threat/TL-2026-1339) — HIGH · 2026-07-14 ## Sources Enriched from CVE.org, NVD, CISA KEV, GitHub Security Advisories. Last verified by Threadlinqs on 2026-07-14. This product uses the NVD API but is not endorsed or certified by the NVD. **Vendor advisory and patch** - [msrc.microsoft.com — vendor advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164) Canonical: https://intel.threadlinqs.com/cve/CVE-2026-56164 Full detection coverage and IOCs for threats exploiting CVE-2026-56164 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp