{"id":2693,"date":"2026-07-15T04:01:02","date_gmt":"2026-07-15T11:01:02","guid":{"rendered":"https:\/\/www.cycognito.com\/blog\/?p=2693"},"modified":"2026-07-15T04:01:03","modified_gmt":"2026-07-15T11:01:03","slug":"emerging-threat-cve-2026-56164-sharepoint-server-privilege-escalation-via-missing-authentication","status":"publish","type":"post","link":"https:\/\/www.cycognito.com\/blog\/emerging-threat-cve-2026-56164-sharepoint-server-privilege-escalation-via-missing-authentication\/","title":{"rendered":"Emerging Threat: (CVE-2026-56164) SharePoint Server Privilege Escalation via Missing Authentication"},"content":{"rendered":"\n
\"\"
Sample of assets impacted by SharePoint Server Privilege Escalation vulnerability, identified by the CyCognito Platform<\/em><\/figcaption><\/figure>\n\n\n\n

What is CVE-2026-56164?<\/h2>\n\n\n\n

CVE-2026-56164 is a privilege escalation vulnerability in on-premises Microsoft SharePoint Server, caused by a missing authentication check on a critical function (CWE-306). An unauthenticated attacker can exploit it over a network, with no credentials and no user interaction required.<\/p>\n\n\n\n

The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium), and Microsoft rates it Moderate. That number places it well below the dozens of Critical-rated flaws in the same release, but severity is not the signal that matters here. Microsoft has confirmed exploitation in the wild, and the flaw was disclosed as a zero-day.<\/p>\n\n\n\n

The discovery was credited to Mandiant incident responders and Google’s FLARE team, which typically indicates the flaw was found inside active attacks rather than through routine research. Microsoft has not detailed how it was exploited or by whom.<\/p>\n\n\n\n

The practical impact is elevation of privilege on the SharePoint host. In observed on-premises SharePoint attacks, privilege escalation is rarely the endpoint. It is chained with remote code execution and post-exploitation steps such as stealing IIS machine keys and abusing deserialization to establish persistence, which is why a Moderate-rated flaw on an internet-facing server warrants priority attention.<\/p>\n\n\n\n

What assets are affected by CVE-2026-56164?<\/h2>\n\n\n\n

The vulnerability affects on-premises SharePoint Server across all currently supported builds: SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. SharePoint Online is not in scope. This is a self-hosted server problem.<\/p>\n\n\n\n

In practice, an affected asset is an internet-facing SharePoint farm: a collaboration portal, document store, intranet gateway, or extranet site running IIS and exposed to untrusted networks. These systems tend to be reachable because they were built to be reached, often by partners, contractors, and remote staff, and they accumulate over years without consistent ownership.<\/p>\n\n\n\n

The exposure is compounded by timing. SharePoint Server 2016 and 2019 reached the end of extended support on July 14, 2026, and neither has a paid extended security update program to fall back on. Organizations still running those versions are now operating unsupported software, leaving Subscription Edition as the only fully supported self-hosted option. A further servicing note applies: SharePoint updates are delivered through the product’s own servicing process, so installing the Windows cumulative update does not patch the SharePoint farm.<\/p>\n\n\n\n

What does our data show about exposure patterns?<\/h2>\n\n\n\n
GICS Sector<\/th>Share<\/th><\/tr><\/thead>
Information Technology<\/td>25.6%<\/td><\/tr>
Consumer Discretionary<\/td>22.0%<\/td><\/tr>
Industrials<\/td>13.4%<\/td><\/tr>
Others<\/td>39.0%<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Exposure in this set is led by Information Technology at 25.6% of observed assets, with Consumer Discretionary contributing 22.0%. Industrials accounts for a further 13.4%.<\/p>\n\n\n\n

Information Technology’s position at the top is consistent with how these organizations operate. Technology and services firms run large, distributed web estates, maintain collaboration portals for internal teams and external partners, and frequently inherit infrastructure through acquisitions and integrations. SharePoint often sits at the seam between corporate IT and customer-facing delivery, where ownership is ambiguous and decommissioning lags behind the pace of new deployment.<\/p>\n\n\n\n

The spread across Consumer Discretionary, Industrials, and the long tail of other sectors points to a common driver rather than an industry-specific one. On-premises SharePoint predates most current asset inventory efforts, and farms stood up for a single project or business unit often outlive the teams that created them. The result is externally reachable collaboration infrastructure that no longer maps cleanly to an owner, which is exactly the condition that lets a network-exploitable flaw go unnoticed.<\/p>\n\n\n\n

Are fixes available?<\/h2>\n\n\n\n

Yes. Microsoft released patches for CVE-2026-56164 in the July 14, 2026 Patch Tuesday update, covering the affected on-premises versions.<\/p>\n\n\n\n

The patch must be applied through SharePoint’s own servicing process. Deploying the month’s Windows cumulative update alone does not remediate a SharePoint farm, and administrators should confirm that the SharePoint-specific security update has been identified, deployed, and validated on each server.<\/p>\n\n\n\n

Organizations still running SharePoint Server 2016 or 2019 should note that both reached end of extended support on the same day the fix shipped. Where a supported update path is unavailable, defenders should treat the affected farm as an unsupported, high-risk asset and plan migration to Subscription Edition or a managed alternative. Verify patch status directly against Microsoft’s advisory rather than assuming coverage from a general Windows update.<\/p>\n\n\n\n

Are there any other recommended actions to take?<\/h2>\n\n\n\n

Until patching is confirmed across all farms, defenders should:<\/p>\n\n\n\n