What’s Vulnerable › Vulnerabilities

CVE-2026-56164: Microsoft SharePoint Server Elevation of Privilege Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-07-14
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-14 · updated 2026-10-28
• Weakness: CWE-306

Description

Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

Summary

CVE-2026-56164 is a critical (CVSS 9.8) missing authentication flaw in a critical function of Microsoft SharePoint Server that lets an unauthenticated attacker elevate privileges over the network. It affects Microsoft SharePoint Server and is fixed in version 16.0.19725.20434. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, so it poses immediate risk to internet-exposed instances. Apply the vendor fix (16.0.19725.20434) or CISA-directed mitigations immediately, and discontinue use if mitigations are unavailable.

تُعد CVE-2026-56164 ثغرة حرجة (CVSS 9.8) ناتجة عن غياب المصادقة في وظيفة حساسة في Microsoft SharePoint Server، ما يتيح لمهاجم غير مُصادَق عليه رفع صلاحياته عبر الشبكة. تؤثر الثغرة في Microsoft SharePoint Server وتُعالَج في الإصدار 16.0.19725.20434. الثغرة مُدرجة في كتالوج CISA للثغرات المعروفة باستغلالها مع استغلال نشط، ما يشكّل خطراً فورياً على الأنظمة المكشوفة على الإنترنت. طبّق إصلاح المورّد (16.0.19725.20434) أو التخفيفات التي توجّه بها CISA فوراً، وتوقّف عن استخدام المنتج إذا تعذّرت التخفيفات.

Affected products

• Microsoft SharePoint Server: before 16.0.19725.20434; 2016, 2019 — fixed in 16.0.19725.20434
• Microsoft SharePoint Server Subscription Edition: from 16.0.0 before 16.0.19725.20434 — fixed in 16.0.19725.20434
• Microsoft Sharepoint Enterprise Server 2016: from 16.0.0 before 16.0.5561.1001 — fixed in 16.0.5561.1001
• Microsoft SharePoint Server: from 16.0.0 before 16.0.10417.20175 — fixed in 16.0.10417.20175

How to fix

Upgrade to a fixed version: Microsoft SharePoint Server 16.0.19725.20434; Microsoft SharePoint Server Subscription Edition 16.0.19725.20434; Microsoft Sharepoint Enterprise Server 2016 16.0.5561.1001; Microsoft SharePoint Server 16.0.10417.20175. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56164

Get alerted when CVE-2026-56164 or the next vulnerability affects your stack