# CVE-2026-56164: Microsoft SharePoint Server Missing-Authentication Vulnerability Actively Exploited, Added to CISA KEV

> CVE-2026-56164 is a missing-authentication (CWE-306) elevation-of-privilege flaw in on-premises Microsoft SharePoint Server that lets an unauthenticated network attacker escalate privileges with no user interaction. Microsoft confirmed active exploitation and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-14, giving federal agencies until 2026-07-17 to remediate under BOD 26-04.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1369
- **ID:** TL-2026-1369
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-56164, CVE-2026-56155, CVE-2026-55040, CVE-2026-32201, CVE-2026-45659

## Description

CVE-2026-56164 is a missing-authentication-for-critical-function vulnerability (CWE-306) in on-premises Microsoft SharePoint Server, disclosed and patched as part of Microsoft's record-breaking July 2026 Patch Tuesday release (622 total CVEs, including 416 Windows flaws). The vulnerability allows an unauthorized, unauthenticated attacker to remotely elevate privileges over the network with low attack complexity and no prior credentials or user interaction, making exploitation reliable and repeatable. NVD rates the flaw 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), while Microsoft's own scoring is comparatively conservative at 5.3 MEDIUM (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) — a discrepancy multiple outlets flagged as understating real-world risk given confirmed in-the-wild exploitation. Reporting from BleepingComputer indicates exploitation of the underlying class of SharePoint flaw allows attackers to bypass authentication, achieve remote code execution, and conduct post-exploitation activity including theft of IIS machine keys (used to forge authentication tokens and maintain persistent access) and deployment of malware. Microsoft credited discovery to Mandiant/Google FLARE incident responders and an anonymous researcher, consistent with detection during active-attack incident response rather than proactive research. Affected products are on-premises SharePoint Enterprise Server 2016 (pre-16.0.5561.1001), SharePoint Server 2019 (pre-16.0.10417.20175), and SharePoint Server Subscription Edition (pre-16.0.19725.20434); SharePoint Online is not affected. CVE-2026-56164 was patched and disclosed as exploited in the same release cycle as a second actively-exploited zero-day, CVE-2026-56155 (Active Directory Federation Services elevation of privilege, CVSS 7.8), and alongside a separately-embargoed authentication-bypass/RCE exploit chain (CVE-2026-55040, a JWT validation bypass discovered by Rapid7's Stephen Fewer, whose second chain component remains embargoed until August 2026). CISA's KEV alert also references two other actively-exploited on-premises SharePoint vulnerabilities from earlier in 2026 (CVE-2026-32201, added 2026-04-14, and CVE-2026-45659, added 2026-07-01), with Shadowserver reporting nearly 10,000 internet-exposed SharePoint servers and over 800 still unpatched against those two flaws alone. This continues a well-established pattern: on-premises SharePoint has been a recurring high-value target since the July 2025 'ToolShell' campaign (CVE-2025-49706 auth bypass chained with CVE-2025-49704 deserialization RCE, tracked by MITRE as Campaign C0058), which was exploited by Chinese state-sponsored actors Linen Typhoon and Violet Typhoon and by the Storm-2603 threat actor to deploy 4L4MD4R ransomware, a Mauri870-derived open-source ransomware variant. Microsoft's recommended interim mitigation for CVE-2026-56164 is enabling the Antimalware Scan Interface (AMSI) integration with Request Body Scan set to Full mode; the primary remediation is installing the July 2026 security update. CISA urges hardening beyond patching alone, and directs agencies unable to patch or mitigate to disconnect affected on-premises SharePoint instances from federal networks per BOD 26-04.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1210 Exploitation of Remote Services
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1053 Scheduled Task/Job
- T1070 Indicator Removal
- T1083 File and Directory Discovery

## Sources

- [SharePoint Server Vulnerability Exploited - Cyber Security News](https://cybersecuritynews.com/sharepoint-server-vulnerability-exploited/)
- [CVE-2026-56164 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-56164)
- [Known Exploited Vulnerabilities Catalog - CISA](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56164)
- [CISA Urges SharePoint Hardening After New Exploitations](https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations)
- [Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack - The Hacker News](https://thehackernews.com/2026/07/microsoft-patches-record-622-flaws.html)
- [CISA warns admins to patch actively exploited SharePoint flaws - BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-patch-actively-exploited-sharepoint-flaws/)
- [AI-driven bug hunting fuels record Microsoft Patch Tuesday - Help Net Security](https://www.helpnetsecurity.com/2026/07/15/microsoft-patch-tuesday-sharepoint-cve-2026-56164/)
- [Patch Tuesday - July 2026 - Rapid7](https://www.rapid7.com/blog/post/em-patch-tuesday-july-2026/)
- [CVE-2026-56164 Security Update Guide - Microsoft Security Response Center](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164)
- [SharePoint ToolShell Exploitation, Campaign C0058 - MITRE ATT&CK](https://attack.mitre.org/campaigns/C0058/)
- [Disrupting active exploitation of on-premises SharePoint vulnerabilities - Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1369