---
title: "SharePoint CVE-2026-56164: Exploited Unauthenticated 0-Day"
url: https://erroneo.us/security/briefs/sharepoint-cve-2026-56164-zero-day/
description: "On-prem SharePoint 2016/2019/SE zero-day exploited before July 14, 2026 patch, chained toward RCE. Patch, rotate keys, hunt. SharePoint Online unaffected."
type: security-brief
section: "Security Digest"
date_published: 2026-07-14
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-56164", "CVE-2026-45659"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# SharePoint CVE-2026-56164: Exploited Unauthenticated 0-Day

**Verdict: Act now.** Ignore the modest vendor score: this was exploited as a zero-day against on-prem SharePoint, so internet-facing farms need the July 2026 updates, a machine-key rotation and a compromise check now.

- **Who must act:** Anyone running on-premises SharePoint Server Subscription Edition, 2019 or 2016, especially farms published to the internet.
- **Who can relax:** SharePoint Online (Microsoft 365) customers are not affected and have nothing to patch.
- **Affected:** SharePoint Enterprise Server 2016 before 16.0.5561.1001; SharePoint Server 2019 before 16.0.10417.20175; SharePoint Server Subscription Edition before 16.0.19725.20434
- **Fixed:** SharePoint Enterprise Server 2016 16.0.5561.1001; SharePoint Server 2019 16.0.10417.20175; SharePoint Server Subscription Edition 16.0.19725.20434
- **CVEs:** CVE-2026-56164, CVE-2026-45659
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Install the July 2026 SharePoint security update on every server in the farm (Windows cumulative updates alone do not fix SharePoint)
2. Confirm the earlier CVE-2026-45659 update is also in place (it is included in the July builds)
3. Rotate ASP.NET/IIS machine keys after patching and restart IIS
4. Enable AMSI with Full Request Body Scan and restrict internet exposure until patched
5. Audit Farm Administrators and site collection admins for accounts you did not create
6. Plan migration off SharePoint 2016/2019, which left extended support on July 14, 2026

### How to check if you are affected

- Check farm build numbers against the fixed builds in Central Administration or with Get-SPFarm | Select BuildVersion
- Look for new .aspx files in the LAYOUTS directories and unknown admin accounts
- Review IIS logs for unauthenticated POSTs to SharePoint service endpoints from unfamiliar IPs before and after July 14
- Alert on w3wp.exe spawning cmd.exe or powershell.exe on SharePoint servers

## What happened

Microsoft's July 14, 2026 Patch Tuesday, one of the largest on record, included a fix for CVE-2026-56164 in on-premises SharePoint Server. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-56164) calls it "missing authentication for critical function" that "allows an unauthorized attacker to elevate privileges over a network." Microsoft rates it CVSS 3.1 5.3, but its temporal metrics mark exploit code as functional. The flaw was already being exploited: CISA added it to the [KEV catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) the same day, with a three-day federal deadline (July 17) and a requirement for forensic triage. [Tech Insider](https://tech-insider.org/microsoft-patch-tuesday-july-2026-zero-days/) reports that researchers from Mandiant Incident Response and Google's FLARE team found it, which suggests it surfaced during incident-response work.

It was SharePoint's second exploited bug in a month. CVE-2026-45659, an authenticated deserialization RCE (CVSS 8.8) whose [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-45659) was published May 22, entered KEV on July 1 and is flagged there as known to be used in ransomware campaigns. Pairing an unauthenticated privilege escalation with an authenticated RCE is the obvious way to reach code execution. The [Wiz database](https://www.wiz.io/vulnerability-database/cve/cve-2026-56164) (an AI-generated page) says attackers chained 56164 with 45659, CVE-2026-32201 and CVE-2026-55040, and reports IIS machine-key theft. [NopSec](https://www.nopsec.com/blog/microsoft-sharepoint-server-cve-2026-56164/) also describes machine-key theft and deserialization abuse leading to persistent backdoors. Microsoft has not published a full root-cause or campaign write-up as of October 21, 2026.

## Who is affected

Only on-premises SharePoint is affected. The CVE record and the [NCSC Ireland advisory](https://www.ncsc.gov.ie/pdfs/2607150243_CVE-2026-56164.pdf) list Enterprise Server 2016 before 16.0.5561.1001, Server 2019 before 16.0.10417.20175, and Subscription Edition before 16.0.19725.20434. SharePoint Online is not affected. NopSec notes that July 14 was also the end of extended support for SharePoint 2016 and 2019.

## Do you really need to act?

Don't let the 5.3 score set your priority. NCSC Ireland lists a 9.8 score, and Microsoft's own 5.3 describes the isolated bug rather than how it is being used. What matters is that it needs no authentication, was exploited before a patch existed, and sits in a product attackers have repeatedly turned into full farm compromise. If your farm is reachable from the internet, this is a drop-everything item. Internal-only farms should still patch this week, because anyone with a foothold on the network can reach them.

Patching alone is not enough if you were exposed before July 14. Stolen machine keys let an attacker forge valid signed payloads even after the patch is installed, which is why rotating the keys belongs in the response.

## What to do now

1. Install the July 2026 SharePoint updates on every farm server, then run the configuration wizard (`PSConfig`) as usual. Windows OS cumulative updates do not patch SharePoint.
2. Verify the build: `(Get-SPFarm).BuildVersion` should be at or above the fixed builds listed above. Those builds also supersede the CVE-2026-45659 fix.
3. Rotate machine keys (`Update-SPMachineKey`, or Central Administration's machine key rotation job), then `iisreset` on each server.
4. Until patched, enable AMSI integration with Full Request Body Scan, as NopSec recommends, and remove direct internet exposure.
5. Audit Farm Administrators and site collection administrators for accounts you did not create.
6. Budget for moving off 2016/2019 to Subscription Edition or SharePoint Online.

## How to tell if you were hit

- Unexpected `.aspx` files in the `TEMPLATE\LAYOUTS` folders, or recently modified web.config files.
- `w3wp.exe` spawning `cmd.exe` or `powershell.exe`, especially with encoded commands.
- New or changed accounts in Farm Administrators.
- Unauthenticated requests to SharePoint service endpoints from unfamiliar IPs in IIS logs, both before and after July 14. Because CISA requires forensic triage for this entry, preserve the logs before rotating anything.

## Timeline

- Apr 14, 2026 — Earlier SharePoint spoofing bug CVE-2026-32201 added to KEV.
- May 22, 2026 — CVE-2026-45659 (authenticated RCE) published.
- Jul 1, 2026 — CVE-2026-45659 added to KEV, flagged for ransomware use.
- Jul 14, 2026 — CVE-2026-56164 patched and added to KEV; SharePoint 2016/2019 leave extended support.
- Jul 16, 2026 — NCSC Ireland advisory.
- Aug 18, 2026 — Another SharePoint bug, CVE-2026-55040, added to KEV.

## Sources

1. [CVE.org — CVE-2026-56164](https://www.cve.org/CVERecord?id=CVE-2026-56164)
2. [CVE.org — CVE-2026-45659](https://www.cve.org/CVERecord?id=CVE-2026-45659)
3. [CISA — Known Exploited Vulnerabilities catalog (JSON feed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
4. [NCSC Ireland — Advisory: Critical Vulnerability exists in Microsoft SharePoint Server CVE-2026-56164](https://www.ncsc.gov.ie/pdfs/2607150243_CVE-2026-56164.pdf)
5. [NopSec — Microsoft SharePoint Server CVE-2026-56164](https://www.nopsec.com/blog/microsoft-sharepoint-server-cve-2026-56164/)
6. [Tech Insider — Microsoft Patch Tuesday July 2026 zero-days](https://tech-insider.org/microsoft-patch-tuesday-july-2026-zero-days/)
7. [Wiz — Vulnerability database: CVE-2026-56164](https://www.wiz.io/vulnerability-database/cve/cve-2026-56164)

---
Source page: https://erroneo.us/security/briefs/sharepoint-cve-2026-56164-zero-day/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt