CVE-2026-56164: Microsoft SharePoint missing authentication in critical function

CVE-2026-56164 · Severity: critical · CVSS 5.3 · Exploited in the wild · Published 2026-07-14

Microsoft SharePoint, a widely used platform for document management and team collaboration, contains a security flaw that allows unauthorized users to perform actions they should not be able to. An attacker could exploit this over the network to gain higher-level permissions within the system without needing to log in. This could lead to unauthorized changes to site settings or data, potentially compromising the integrity of corporate information.

Technologies: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition. Vendors: Microsoft.

Quick answers

Is CVE-2026-56164 exploited in the wild?
Yes. CVE-2026-56164 is known to be exploited in the wild, first recorded on 14 July 2026. Treat it as urgent.
How severe is CVE-2026-56164?
Critical severity, with a CVSS score of 5.3, published 14 July 2026.
Which products and versions are affected?
Microsoft SharePoint Enterprise Server 2016 16.0.0 to < 16.0.5561.1001, 16.0.0 to 16.0.5561.1001; Microsoft SharePoint Server 2019 16.0.0 to < 16.0.10417.20175, 16.0.0 to 16.0.10417.20175; Microsoft SharePoint Server Subscription Edition 16.0.0 to < 16.0.19725.20434, 16.0.0 to 16.0.19725.20434.
Is there a fix for CVE-2026-56164?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56164 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-56164?
Check whether you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server, Microsoft SharePoint Server 2019 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as Missing Authentication for Critical Function (CWE-306) exists in multiple versions of Microsoft SharePoint Server. The flaw allows an unauthenticated attacker to perform actions that should require authorization, leading to a privilege escalation. The attack can be carried out remotely over the network without any user interaction. Microsoft has released updates to address this issue in SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Although the advisory mentions active exploitation in the wild, the CVSS 3.1 score provided by the vendor is 5.3 (Medium).

Affected products

  • Microsoft SharePoint Enterprise Server 2016 16.0.0 to < 16.0.5561.1001
  • Microsoft SharePoint Server 2019 16.0.0 to < 16.0.10417.20175
  • Microsoft SharePoint Server Subscription Edition 16.0.0 to < 16.0.19725.20434

Timeline

  • 2026-07-14: advisory: Initial publication by Microsoft and NVD
  • 2026-07-14: exploited: Reported as exploited in the wild at time of publication

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.