CVE-2026-56164: Microsoft SharePoint Server missing authentication allows privilege elevation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 9.8 pre-auth network flaw in SharePoint with CISA KEV listing and a three-day federal remediation deadline indicates active exploitation and severe impact.

What it is

Microsoft Office SharePoint Server contains a missing authentication flaw in a critical function (CWE-306), letting an unauthenticated attacker reach that function directly over the network. Because no credentials or user interaction are required and the impact spans confidentiality, integrity and availability, this is a severe pre-auth issue for any exposed SharePoint deployment.

Impact

An unauthenticated network attacker can invoke a critical function without logging in and elevate privileges, gaining high-level control over confidentiality, integrity and availability of the SharePoint environment.

Attack surface

Reachable over the network via the affected SharePoint endpoint with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet- or intranet-exposed SharePoint Server instance running the vulnerable code is in scope.

Exploitation

CVE-2026-56164 was added to CISA KEV on 2026-07-14 with a remediation due date of 2026-07-17, indicating known exploitation; EPSS gives a 30-day probability of 0.26636 (97.9th percentile). No ransomware campaign use is documented in the record.

What to do

• Apply the Microsoft vendor update for CVE-2026-56164 immediately, following the MSRC update guide.
• If patching cannot be completed by the CISA due date, apply the vendor-recommended mitigations or discontinue use of the affected product per BOD 26-04.
• Restrict network access to SharePoint endpoints (block or filter external exposure) until patched.
• Inventory all SharePoint Server instances and confirm which are internet-facing, prioritizing those for emergency patching.
• Monitor vendor and CISA guidance for updated mitigation instructions.

Detection

• Review SharePoint and IIS logs for requests to critical functions from unauthenticated or unexpected source IPs.
• Alert on anomalous privilege changes or administrative actions originating from sessions with no prior authentication.
• Hunt for exploitation attempts against SharePoint endpoints using the vendor advisory and CISA KEV details as indicators.
• Correlate web server access logs with authentication logs to find successful critical-function calls lacking a matching login event.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.