Loading story…
Microsoft disclosed CVE-2026-56164, an elevation-of-privilege vulnerability in Microsoft SharePoint Server caused by missing authentication for a critical function. The flaw is remotely exploitable over the network with low attack complexity, requires no privileges or user interaction, and Microsoft says exploitation has been detected in the wild. Reporting on the issue indicates attackers can abuse improper request validation in a SharePoint client service endpoint to bypass expected X-RequestDigest checks under certain routing conditions and obtain an elevated administrative security context.
Successful exploitation can allow unauthorized takeover of site collections and farm configurations, data exfiltration, persistence through permission changes, and potential lateral movement into the wider Windows Server environment, particularly on internet-exposed SharePoint systems. Microsoft has released a security update and recommends enabling AMSI integration and full request-body scanning in SharePoint and IIS worker process memory; additional reporting also points to IIS URL Rewrite filtering of unauthenticated requests to the vulnerable client service endpoint as a temporary defensive measure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published Alert AL26-017 warning about three Microsoft SharePoint Server vulnerabilities: CVE-2026-56164, CVE-2026-55040, and CVE-2026-58644. The alert urged organizations to patch affected SharePoint 2016, 2019, and Subscription Edition systems, watch for compromise indicators such as web shells and machine key theft, reduce internet exposure, and noted that SharePoint 2016 and 2019 reached end of life on July 14, 2026.
A subsequent report said CVE-2026-56164 was included in CISA's Known Exploited Vulnerabilities catalog and was being actively exploited against internet-exposed SharePoint infrastructure. The report described potential impacts including privilege escalation, SharePoint takeover, data exfiltration, persistence, and lateral movement.
In its advisory, Microsoft stated that exploitation of CVE-2026-56164 had been detected in the wild and that an official fix was available. The guidance also recommended enabling AMSI integration and full request-body scanning in SharePoint and IIS worker process memory as mitigations.
Microsoft published CVE-2026-56164, an elevation-of-privilege vulnerability in Microsoft SharePoint Server caused by missing authentication for a critical function. Microsoft rated it Moderate with CVSS 5.3 and described it as remotely exploitable with low attack complexity and no required privileges or user interaction.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcesecurityweek.com
Open sourcecybersecuritynews.com
Open sourcethreataft.com
Open sourcecvereports.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
More than **1,370 internet-facing Microsoft SharePoint servers** were reported exposed to active exploitation of **`CVE-2026-32201`**, a spoofing vulnerability affecting SharePoint Server 2016, 2019, and Subscription Edition. Microsoft disclosed the flaw in April and CISA added it to the **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders. Although Microsoft scored the bug at **CVSS 6.5**, the risk is elevated because it can be exploited **remotely without authentication** against exposed on-premises deployments, potentially allowing attackers to impersonate users, access or alter sensitive content, steal credentials, and move laterally inside victim environments. The exposure comes amid broader concern over SharePoint security, including Microsoft's disclosure of **`CVE-2026-26106`**, a **remote code execution** vulnerability in SharePoint Server, and earlier reporting that a **China-linked threat actor** was involved in SharePoint attacks, according to Mandiant. The concentration of exposed systems was highest in the **United States**, and the combined reporting points to sustained attacker interest in SharePoint as a route into enterprise networks. Organizations were urged to apply Microsoft's available updates, reduce direct internet exposure of SharePoint servers, and closely monitor authentication and document-access activity for signs of compromise.
Jun 29, 2026
A critical Microsoft SharePoint remote code execution flaw, **CVE-2026-50522** (`CVSS 9.8`), is being actively exploited against on-premises deployments after Microsoft released fixes for affected versions of **SharePoint Enterprise Server 2016**, **SharePoint Server 2019**, and **SharePoint Subscription Edition**. The vulnerability stems from unsafe deserialization of untrusted data and can be triggered through unauthenticated requests, making internet-facing SharePoint farms particularly exposed. Researchers reported likely real-world exploitation against honeypots, and public proof-of-concept code is now available. Reporting indicates attackers have targeted on-prem SharePoint instances and, in some cases, stolen machine keys to help preserve long-term access. The flaw was originally demonstrated during **Pwn2Own Berlin**, where exploit code was shown and shared with Microsoft before the vendor issued patches. Organizations running exposed SharePoint servers have been urged to apply the fixed versions immediately and, if patching cannot be completed at once, restrict external access and review logs for suspicious requests to SharePoint sign-in pages.
Jul 22, 2026
Microsoft disclosed and patched **CVE-2026-58644**, a critical remote code execution flaw in **Microsoft SharePoint** caused by insecure deserialization of untrusted data (`CWE-502`). The vulnerability carries a **CVSS 9.8** rating and allows an **unauthorized attacker** to execute arbitrary code over the network by sending a crafted HTTP request, with **no user interaction required**. Affected products include **SharePoint Enterprise Server 2016**, **SharePoint Server 2019**, and **SharePoint Server Subscription Edition** prior to patched versions published through Microsoft's security guidance. Reporting on the release said no active exploitation had been confirmed at disclosure, but warned that exploitation is likely because SharePoint is widely deployed in enterprises; organizations were urged to prioritize patching internet-exposed SharePoint systems, review access permissions, and monitor server logs for suspicious activity.
Jul 17, 2026