Medium severity5.3CISA KEVNVD Advisory· Published Jul 14, 2026· Updated Jul 14, 2026
CVE-2026-56164
CVE-2026-56164
Description
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
Affected products
5cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*+ 3 more
- cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*range: <16.0.19725.20434
- cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*
- cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*
- (no CPE)
Patches
Vulnerability mechanics
References
2- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164nvdVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
6- SharePoint Vulnerability Exploited Shortly After PoC ReleaseSecurityWeek · Aug 12, 2026
- 200 accounts compromised in Swiss government’s Microsoft SharePoint breachHelp Net Security · Aug 7, 2026
- Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breachedHelp Net Security · Jul 26, 2026
- Another SharePoint RCE exploited: Patch, then rotate your machine keys (CVE-2026-50522)Help Net Security · Jul 22, 2026
- Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of AttacksSecurityWeek · Jul 22, 2026
- Microsoft: 2 Actively-Exploited Flaws Added to CISA KEVVypr Intelligence · Jul 14, 2026