# Actively Exploited SharePoint Server Elevation of Privilege Flaw (CVE-2026-56164) Patched Alongside Critical RCE Pair in July 2026 Patch Tuesday

> Microsoft's July 2026 Patch Tuesday (569-622 CVEs, the largest single release on record) fixes CVE-2026-56164, a low-complexity, unauthenticated SharePoint Server elevation-of-privilege flaw exploited in the wild as a zero-day and discovered by Google/Mandiant FLARE incident responders. The same SharePoint release bundles two critical (CVSS 9.8) deserialization RCE flaws (CVE-2026-50522, CVE-2026-58644) demonstrated live at Pwn2Own Berlin by Rapid7, and a critical (CVSS 9.1) JWT/authentication security-feature bypass (CVE-2026-55040) that Rapid7 has chained to a separate, still-embargoed RCE for full unauthenticated remote code execution.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-25T11:36:50.613Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1364
- **ID:** TL-2026-1364
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-56164, CVE-2026-50522, CVE-2026-58644, CVE-2026-55040

## Description

On July 14, 2026, Microsoft shipped its largest Patch Tuesday to date (reported between 569 and 622 total CVEs across vendors/sources), including a cluster of four Microsoft Office SharePoint vulnerabilities. CVE-2026-56164 is a CWE-306 (Missing Authentication for Critical Function) elevation-of-privilege flaw: an unauthenticated, unauthorized attacker can send a crafted network request (POST to a SharePoint API endpoint) with no user interaction and no credentials to elevate SharePoint permissions. Despite a moderate CVSS 3.1 base score of 5.3 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C), Microsoft confirmed exploitation in the wild as a zero-day, and the flaw was reported by Google incident responders (Mandiant/FLARE) and an anonymous researcher, indicating it surfaced during live incident response rather than routine bug hunting. CISA added CVE-2026-56164 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-07-14 with a 2026-07-17 remediation deadline under BOD 26-04. Microsoft's stated mitigation, short of patching, is enabling AMSI (Antimalware Scan Interface) integration with Request Body Scan set to Full mode to detect malicious POST requests. The disclosure also lands the same week SharePoint Server 2016 and 2019 reached end of extended support (2026-07-14), narrowing the practical remediation path for legacy on-premises farms to migration or Subscription Edition upgrade. Bundled in the same SharePoint release are two matching critical RCE vulnerabilities, CVE-2026-50522 and CVE-2026-58644 (each CVSS 3.1 9.8, CWE-502 Deserialization of Untrusted Data, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which allow an attacker (reported variously as unauthenticated or as requiring at minimum Site Owner/Site Member web permissions depending on source) to have SharePoint deserialize attacker-controlled data and execute arbitrary code on the server. CVE-2026-50522 was demonstrated live against Microsoft at Pwn2Own Berlin by Rapid7, handing Microsoft a working exploit chain directly -- ZDI analysts flagged it as notable that Microsoft nonetheless listed exploit maturity as 'Unknown.' A fourth SharePoint flaw, CVE-2026-55040, is a critical (CVSS 3.1 9.1, CWE-1390 Weak Authentication, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) JWT-based security-feature-bypass discovered by Rapid7 Senior Principal Security Researcher Stephen Fewer at Pwn2Own Berlin; Rapid7 disclosed it is the first half of a two-part exploit chain, with the paired unauthenticated RCE component remaining embargoed until Microsoft's August 2026 release. Chained together, the SharePoint EoP and RCE flaws in this release represent the classic on-premises SharePoint compromise pattern (as previously seen in the CVE-2026-45659/ToolShell-style attacks CISA flagged into KEV on 2026-07-02): initial unauthenticated network access, deserialization-driven remote code execution, privilege escalation to farm/administrator context, and follow-on web shell persistence for long-term access -- a pattern historically favored by ransomware affiliates and nation-state actors targeting internet-facing SharePoint farms.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1505.003 Server Software Component: Web Shell
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1553 Subvert Trust Controls
- T1606 Forge Web Credentials
- T1082 System Information Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1489 Service Stop
- T1592 Gather Victim Host Information
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1552 Unsecured Credentials
- T1550 Use Alternate Authentication Material
- T1078 Valid Accounts
- T1041 Exfiltration Over C2 Channel
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1140 Deobfuscate/Decode Files or Information
- T1685.005 Clear Windows Event Logs
- T1528 Steal Application Access Token
- T1606.002 Forge Web Credentials: SAML Tokens
- T1552.001 Unsecured Credentials: Credentials In Files
- T1083 File and Directory Discovery
- T1087 Account Discovery
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1213.002 Data from Information Repositories: SharePoint
- T1565 Data Manipulation

## Sources

- [Microsoft Patch Tuesday: SharePoint CVE-2026-56164 actively exploited](https://www.helpnetsecurity.com/2026/07/15/microsoft-patch-tuesday-sharepoint-cve-2026-56164/)
- [Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164)](https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164)
- [Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack](https://thehackernews.com/2026/07/microsoft-patches-record-622-flaws.html)
- [Patchpocalypse Now: Microsoft tops last month's record with 622 Patch Tuesday CVEs](https://www.theregister.com/security/2026/07/14/patchpocalypse-now-microsoft-tops-last-months-record-with-622-patch-tuesday-cves/5271434)
- [Record-Breaking Microsoft Patch Tuesday Update: 570 Vulnerabilities Fixed, Including 3 Zero-Days](https://cybersecuritynews.com/microsoft-patch-tuesday-update-july-2026/)
- [Zero Day Initiative — The July 2026 Security Update Review](https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review)
- [Patch Tuesday security updates for July 2026, the largest update ever. 621 CVEs in one month](https://securityaffairs.com/195347/security/patch-tuesday-security-updates-for-july-2026-the-largest-update-ever-621-cves-in-one-month.html)
- [CVE-2026-56164 Detail](https://vulnerability.circl.lu/vuln/CVE-2026-56164)
- [Microsoft Security Response Center - CVE-2026-56164](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164)
- [Microsoft Security Response Center - CVE-2026-50522](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522)
- [Microsoft Security Response Center - CVE-2026-58644](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644)
- [Microsoft Security Response Center - CVE-2026-55040](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-56164](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56164)
- [CVE-2026-56164 SharePoint Exploit: Patch July 14 Now](https://windowsforum.com/threads/cve-2026-56164-sharepoint-exploit-patch-july-14-now.438466/)
- [CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability](https://www.securityweek.com/cisa-warns-of-actively-exploited-microsoft-sharepoint-vulnerability/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1364