Actively Exploited SharePoint Server Elevation of Privilege Flaw (CVE-2026-56164) Patched Alongside Critical RCE Pair in July 2026 Patch Tuesday
Actively Exploited SharePoint Server Elevation of Privilege (TL-2026-1364), also tracked as July 2026 Patch Tuesday SharePoint Flaws, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-15 and last reviewed 2026-07-25. It has no confirmed attribution, affects Microsoft SharePoint Enterprise Server 2016, references 4 CVEs (CVE-2026-56164, CVE-2026-50522, CVE-2026-58644), maps to 34 MITRE ATT&CK techniques (T1005, T1041, T1059), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-1364
- Threat ID
- TL-2026-1364
- Also known as
- July 2026 Patch Tuesday SharePoint Flaws, SharePoint EoP+RCE Chain July 2026
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-15
- Last reviewed
- 2026-07-25
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, education, critical-infrastructure
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 28
- Updates
- 2026-07-25 · 2 updates · revalidated 2× · latest source
Malware and tooling in Actively Exploited SharePoint Server Elevation of Privilege
Malware and tooling: AMSI (Antimalware Scan Interface)
Microsoft's July 2026 Patch Tuesday (569-622 CVEs, the largest single release on record) fixes CVE-2026-56164, a low-complexity, unauthenticated SharePoint Server elevation-of-privilege flaw exploited in the wild as a zero-day and discovered by Google/Mandiant FLARE incident responders. The same SharePoint release bundles two critical (CVSS 9.8) deserialization RCE flaws (CVE-2026-50522, CVE-2026-58644) demonstrated live at Pwn2Own Berlin by Rapid7, and a critical (CVSS 9.1) JWT/authentication security-feature bypass (CVE-2026-55040) that Rapid7 has chained to a separate, still-embargoed RCE for full unauthenticated remote code execution.
How Actively Exploited SharePoint Server Elevation of Privilege works
On July 14, 2026, Microsoft shipped its largest Patch Tuesday to date (reported between 569 and 622 total CVEs across vendors/sources), including a cluster of four Microsoft Office SharePoint vulnerabilities. CVE-2026-56164 is a CWE-306 (Missing Authentication for Critical Function) elevation-of-privilege flaw: an unauthenticated, unauthorized attacker can send a crafted network request (POST to a SharePoint API endpoint) with no user interaction and no credentials to elevate SharePoint permissions. Despite a moderate CVSS 3.1 base score of 5.3 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C), Microsoft confirmed exploitation in the wild as a zero-day, and the flaw was reported by Google incident responders (Mandiant/FLARE) and an anonymous researcher, indicating it surfaced during live incident response rather than routine bug hunting. CISA added CVE-2026-56164 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-07-14 with a 2026-07-17 remediation deadline under BOD 26-04. Microsoft's stated mitigation, short of patching, is enabling AMSI (Antimalware Scan Interface) integration with Request Body Scan set to Full mode to detect malicious POST requests. The disclosure also lands the same week SharePoint Server 2016 and 2019 reached end of extended support (2026-07-14), narrowing the practical remediation path for legacy on-premises farms to migration or Subscription Edition upgrade. Bundled in the same SharePoint release are two matching critical RCE vulnerabilities, CVE-2026-50522 and CVE-2026-58644 (each CVSS 3.1 9.8, CWE-502 Deserialization of Untrusted Data, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which allow an attacker (reported variously as unauthenticated or as requiring at minimum Site Owner/Site Member web permissions depending on source) to have SharePoint deserialize attacker-controlled data and execute arbitrary code on the server. CVE-2026-50522 was demonstrated live against Microsoft at Pwn2Own Berlin by Rapid7, handing Microsoft a working exploit chain directly -- ZDI analysts flagged it as notable that Microsoft nonetheless listed exploit maturity as 'Unknown.' A fourth SharePoint flaw, CVE-2026-55040, is a critical (CVSS 3.1 9.1, CWE-1390 Weak Authentication, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) JWT-based security-feature-bypass discovered by Rapid7 Senior Principal Security Researcher Stephen Fewer at Pwn2Own Berlin; Rapid7 disclosed it is the first half of a two-part exploit chain, with the paired unauthenticated RCE component remaining embargoed until Microsoft's August 2026 release. Chained together, the SharePoint EoP and RCE flaws in this release represent the classic on-premises SharePoint compromise pattern (as previously seen in the CVE-2026-45659/ToolShell-style attacks CISA flagged into KEV on 2026-07-02): initial unauthenticated network access, deserialization-driven remote code execution, privilege escalation to farm/administrator context, and follow-on web shell persistence for long-term access -- a pattern historically favored by ransomware affiliates and nation-state actors targeting internet-facing SharePoint farms.
MITRE ATT&CK techniques used in TL-2026-1364
Collection
T1005 Data from Local System; T1213.002 Data from Information Repositories: SharePoint
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071.001 Application Layer Protocol: Web Protocols
Persistence
T1078 Valid Accounts; T1505.003 Server Software Component: Web Shell
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery
Defense Evasion
T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth
Initial Access
T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services; T1550.001 Use Alternate Authentication Material: Application Access Token
Impact
T1489 Service Stop; T1565 Data Manipulation
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1552.001 Unsecured Credentials: Credentials In Files; T1606 Forge Web Credentials; T1606.002 Forge Web Credentials: SAML Tokens
lateral-movement
T1550 Use Alternate Authentication Material
defense-impairment
T1553 Subvert Trust Controls; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Resource Development
T1587 Develop Capabilities; T1588 Obtain Capabilities
Reconnaissance
Affected products and versions in Actively Exploited SharePoint Server Elevation of Privilege
- Microsoft — SharePoint Enterprise Server 2016
Vulnerable versions: < 16.0.5561.1001
Fixed in: 16.0.5561.1001 and later (July 2026 CU) - Microsoft — SharePoint Server 2019
Vulnerable versions: < 16.0.10417.20175
Fixed in: 16.0.10417.20175 and later (July 2026 CU) - Microsoft — SharePoint Server Subscription Edition
Vulnerable versions: < 16.0.19725.20434
Fixed in: 16.0.19725.20434 and later (July 2026 CU)
Remediation for Actively Exploited SharePoint Server Elevation of Privilege
Patches
- Microsoft July 2026 security update for CVE-2026-56164 (SharePoint Enterprise Server 2016 < 16.0.5561.1001, SharePoint Server 2019 < 16.0.10417.20175, SharePoint Server Subscription Edition < 16.0.19725.20434)
- Microsoft July 2026 security update for CVE-2026-50522 (SharePoint Server RCE, CWE-502)
- Microsoft July 2026 security update for CVE-2026-58644 (SharePoint Server RCE, CWE-502)
- Microsoft July 2026 security update for CVE-2026-55040 (SharePoint Server security feature bypass, CWE-1390); companion RCE half of the chain patches in August 2026
Immediate actions
- Apply the July 2026 Microsoft SharePoint security updates covering CVE-2026-56164, CVE-2026-50522, CVE-2026-58644, and CVE-2026-55040 without delay
- Enable AMSI (Antimalware Scan Interface) integration on SharePoint Server and set Request Body Scan mode to Full to detect malicious POST requests targeting CVE-2026-56164
- Prioritize patching internet-facing/on-premises SharePoint farms first, per CISA KEV BOD 26-04 3-day remediation window
- Audit SharePoint farms for unexpected .aspx files, web shells, and anomalous IIS worker process (w3wp.exe) child processes indicative of post-exploitation activity
Workarounds
- Enable AMSI Full Mode Request Body Scan as an interim mitigation for CVE-2026-56164 if patching cannot occur immediately
- Temporarily restrict network access to SharePoint API endpoints from untrusted/external sources until patched
Longer-term hardening
- Migrate SharePoint Server 2016/2019 deployments off end-of-extended-support versions (EOS reached 2026-07-14) to SharePoint Subscription Edition or SharePoint Online
- Deploy EDR/behavioral monitoring on SharePoint front-end and application servers to catch deserialization-driven process spawning
- Restrict direct internet exposure of on-premises SharePoint farms behind a WAF/reverse proxy with request inspection
- Establish a routine SharePoint-specific patch cadence given the product's recurring history of critical RCE/EoP chains (e.g., CVE-2026-45659)
CVEs associated with Actively Exploited SharePoint Server Elevation of Privilege
CVE-2026-56164, CVE-2026-50522, CVE-2026-58644, CVE-2026-55040
Weaknesses (CWE) in Actively Exploited SharePoint Server Elevation of Privilege
CWE-306, CWE-502, CWE-1390
Timeline of Actively Exploited SharePoint Server Elevation of Privilege
Showing the 20 most recent tracked events.
- Microsoft patches the related on-premises SharePoint deserialization RCE flaw CVE-2026-45659 across SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, establishing the precedent SharePoint attack chain later mirrored by the July 2026 CVE cluster.
- Microsoft's investigation into CVE-2026-45659 reveals the threat actor Storm-2603 had been exploiting known on-premises SharePoint vulnerabilities since mid-2025, well before that flaw's May 2026 patch, underscoring the persistent targeting of internet-facing SharePoint farms that also applies to the July 2026 CVE-2026-56164 cluster.
- CISA adds the related SharePoint RCE flaw CVE-2026-45659 (CWE-502 deserialization, CVSS 8.8, exploited by Storm-2603) to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation and setting a federal remediation deadline of 2026-07-04, establishing the same on-premises SharePoint attack pattern later seen with CVE-2026-56164.
- Rapid7 discloses that CVE-2026-50522 was demonstrated live against Microsoft at Pwn2Own Berlin (a working exploit handed directly to Microsoft), and that CVE-2026-55040 is the first half of a two-part exploit chain with the paired unauthenticated RCE component embargoed until Microsoft's August 2026 release; Zero Day Initiative publishes its July 2026 Security Update Review analyzing the full CVE cluster and noting Microsoft's 'Unknown' exploit-maturity rating for CVE-2026-50522 despite the working Pwn2Own exploit already in hand.
- SharePoint Server 2016 and SharePoint Server 2019 reach end of extended support, narrowing long-term remediation options for legacy on-premises farms still running these versions.
- CISA adds CVE-2026-56164 to the Known Exploited Vulnerabilities catalog with a remediation due date of 2026-07-17 under BOD 26-04.
- Microsoft confirms CVE-2026-56164 was exploited in the wild as a zero-day prior to patch release, reported by Google incident responders (Mandiant/FLARE) and an anonymous researcher.
- Microsoft releases its July 2026 Patch Tuesday (569-622 total CVEs across reported counts, the largest single release on record), disclosing CVE-2026-56164, CVE-2026-50522, CVE-2026-58644, and CVE-2026-55040 in SharePoint Server.
- Help Net Security publishes coverage of the actively-exploited CVE-2026-56164 SharePoint flaw, triggering downstream hunt/research on the Threadlinqs Intelligence Platform.
- Companion vulnerability CVE-2026-58644 is confirmed exploited in the wild without any public PoC, indicating at least one actor already had working exploit code for the SharePoint deserialization chain before CVE-2026-50522's PoC went public.
- Defused Cyber's honeypot telemetry captures an undocumented .NET deserialization payload targeting SharePoint sign-in endpoints; Censys publishes a joint advisory on CVE-2026-50522/CVE-2026-58644 exposure.
- Defused Cyber updates its July 17 finding, assessing the previously observed pre-disclosure zero-day exploitation was 'likely CVE-2026-50522', formally tying its honeypot captures to the newly patched SharePoint deserialization flaw.
- Censys internet-wide scanning shows roughly 1,500 exposed on-premises SharePoint instances vulnerable to CVE-2026-50522/CVE-2026-58644, concentrated in the US with smaller pockets in Germany, France, Canada, Iran, and Australia.
- Researchers confirm attackers are extracting SharePoint ASP.NET machine keys via a single crafted HTTP request, enabling persistent access independent of the original vulnerability and surviving patching unless keys are rotated.
- watchTowr's Attacker Eye honeypot network and Defused Cyber independently confirm active, in-the-wild exploitation of CVE-2026-50522 against on-premises SharePoint Server deployments.
- A public proof-of-concept exploit for CVE-2026-50522 is released, rapidly followed by observed weaponization.
- SecurityAffairs and The Hacker News publish coverage of the active exploitation wave, reiterating that patching alone does not remediate exposure without machine-key rotation.
- CISA adds CVE-2026-50522 specifically to the Known Exploited Vulnerabilities catalog, confirming active exploitation and setting a Federal Civilian Executive Branch remediation deadline.
- CISA-mandated deadline for U.S. Federal Civilian Executive Branch agencies to remediate CVE-2026-50522 per BOD 22-01 KEV requirements.
- Rapid7-embargoed companion unauthenticated RCE half of the CVE-2026-55040 exploit chain is expected to be disclosed/patched in Microsoft's August 2026 Patch Tuesday release, completing the two-part exploit chain.
Update history for TL-2026-1364
- 2026-07-25 — CVE-2026-50522: Critical SharePoint Server RCE Under Active Exploitation After Public PoC: What changed No severity/exploitability/status change — both records already CRITICAL/ACTIVE/CVSS 9.8. The update adds concrete technical detail (exploitation mechanism and endpoint) and a formal per-CVE KEV/FCEB milestone that the original
- 2026-07-21 — Public PoC Triggers Active Exploitation of Critical SharePoint RCE (CVE-2026-50522): What changed Severity HIGH → CRITICAL: CVE-2026-50522 (already tracked in this threat's cluster) moved from Pwn2Own demo to confirmed active in-the-wild exploitation following a 2026-07-20 public PoC. Exploitability was already ACTIVE and r
Sources cited for Actively Exploited SharePoint Server Elevation of Privilege
- Microsoft Patch Tuesday: SharePoint CVE-2026-56164 actively exploited
- Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164)
- Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack
- Patchpocalypse Now: Microsoft tops last month's record with 622 Patch Tuesday CVEs
- Record-Breaking Microsoft Patch Tuesday Update: 570 Vulnerabilities Fixed, Including 3 Zero-Days
- Zero Day Initiative — The July 2026 Security Update Review
- Patch Tuesday security updates for July 2026, the largest update ever. 621 CVEs in one month
- CVE-2026-56164 Detail
- Microsoft Security Response Center - CVE-2026-56164
- Microsoft Security Response Center - CVE-2026-50522
- Microsoft Security Response Center - CVE-2026-58644
- Microsoft Security Response Center - CVE-2026-55040
- CISA Known Exploited Vulnerabilities Catalog - CVE-2026-56164
- CVE-2026-56164 SharePoint Exploit: Patch July 14 Now
- CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability
Threats related to Actively Exploited SharePoint Server Elevation of Privilege
- Microsoft July 2026 Patch Tuesday: Record 622 Flaws Fixed, Two Zero-Days Under Active Exploitation (CVE-2026-56164, CVE-2026-56155)
- CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV Catalog
- Microsoft July 2026 Patch Tuesday: 570 Vulnerabilities Fixed, Including 2 Actively Exploited Zero-Days (CVE-2026-56164, CVE-2026-56155)
- Microsoft July 2026 Patch Tuesday: Record 622 CVEs Include Two Actively Exploited Zero-Days in AD FS (CVE-2026-56155) and SharePoint Server (CVE-2026-56164)
- Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days in AD FS (CVE-2026-56155) and SharePoint (CVE-2026-56164), Plus Unpatched BitLocker Bypass (CVE-2026-50661)
- July 2026 Patch Tuesday: Two Actively Exploited Microsoft Zero-Days (SharePoint EoP CVE-2026-56164, AD FS EoP CVE-2026-56155) Plus SharePoint JWT Auth Bypass CVE-2026-55040
Detection coverage for TL-2026-1364
As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1364 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.