Actively Exploited SharePoint Server Flaw Lets Attackers Gain Administrator Access

Microsoft disclosed **CVE-2026-56164**, an elevation-of-privilege vulnerability in **Microsoft SharePoint Server** caused by missing authentication for a critical function. The flaw is remotely exploitable over the network with low attack complexity, requires no privileges or user interaction, and Microsoft says exploitation has been detected in the wild. Reporting on the issue indicates attackers can abuse improper request validation in a SharePoint client service endpoint to bypass expected `X-RequestDigest` checks under certain routing conditions and obtain an elevated administrative security context. Successful exploitation can allow unauthorized takeover of site collections and farm configurations, data exfiltration, persistence through permission changes, and potential lateral movement into the wider Windows Server environment, particularly on internet-exposed SharePoint systems. Microsoft has released a security update and recommends enabling **AMSI integration** and full request-body scanning in SharePoint and IIS worker process memory; additional reporting also points to IIS URL Rewrite filtering of unauthenticated requests to the vulnerable client service endpoint as a temporary defensive measure.

Jul 15, 2026

Attackers Exploit SharePoint JWT Authentication Bypass After PoC Release

Threat actors are actively exploiting **CVE-2026-55040**, a critical Microsoft SharePoint authentication bypass flaw with a **CVSS score of 9.1**, after public proof-of-concept code was released. The vulnerability, patched by Microsoft in July 2026, affects SharePoint Server Subscription Edition and allows unauthenticated attackers to forge JWTs, bypass authentication, and impersonate any SharePoint user, including administrators. Researchers said the bug chain stems from multiple weaknesses in SharePoint’s JWT validation pipeline, including acceptance of an outer token using `alg: none` and failures to properly verify certificate trust and token signatures. Security researchers and honeypot operators reported a sharp rise in exploitation attempts immediately after the PoC became public, with telemetry showing 12 attempts since July 19 and most activity concentrated on August 12 and 13. Successful attacks can expose documents, enable data modification across a SharePoint farm, and provide a foothold for broader compromise of connected Microsoft 365 environments, increasing urgency for organizations to apply Microsoft’s patch and review SharePoint access for signs of abuse.

Aug 13, 2026

Microsoft SharePoint Flaws Expose Internet-Facing Servers to Spoofing and RCE Risk

More than **1,370 internet-facing Microsoft SharePoint servers** were reported exposed to active exploitation of **`CVE-2026-32201`**, a spoofing vulnerability affecting SharePoint Server 2016, 2019, and Subscription Edition. Microsoft disclosed the flaw in April and CISA added it to the **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders. Although Microsoft scored the bug at **CVSS 6.5**, the risk is elevated because it can be exploited **remotely without authentication** against exposed on-premises deployments, potentially allowing attackers to impersonate users, access or alter sensitive content, steal credentials, and move laterally inside victim environments. The exposure comes amid broader concern over SharePoint security, including Microsoft's disclosure of **`CVE-2026-26106`**, a **remote code execution** vulnerability in SharePoint Server, and earlier reporting that a **China-linked threat actor** was involved in SharePoint attacks, according to Mandiant. The concentration of exposed systems was highest in the **United States**, and the combined reporting points to sustained attacker interest in SharePoint as a route into enterprise networks. Organizations were urged to apply Microsoft's available updates, reduce direct internet exposure of SharePoint servers, and closely monitor authentication and document-access activity for signs of compromise.

Apr 28, 2026

Actively Exploited SharePoint Server Flaw Lets Attackers Gain Administrator Access

How this story unfolded

CISA warns that CVE-2023-29357 is being actively exploited

Microsoft releases patches for CVE-2023-29357

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Actively Exploited SharePoint Server Flaw Lets Attackers Gain Administrator Access

How this story unfolded

CISA warns that CVE-2023-29357 is being actively exploited

Microsoft releases patches for CVE-2023-29357

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Actively Exploited SharePoint Server Flaw Lets Attackers Gain Administrator Access

How this story unfolded

CISA warns that CVE-2023-29357 is being actively exploited

Microsoft releases patches for CVE-2023-29357

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Actively Exploited SharePoint Flaw Enables Remote Privilege Escalation

Attackers Exploit SharePoint JWT Authentication Bypass After PoC Release

Microsoft SharePoint Flaws Expose Internet-Facing Servers to Spoofing and RCE Risk

Actively Exploited SharePoint Server Flaw Lets Attackers Gain Administrator Access

How this story unfolded

CISA warns that CVE-2023-29357 is being actively exploited

Microsoft releases patches for CVE-2023-29357

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Actively Exploited SharePoint Flaw Enables Remote Privilege Escalation

Attackers Exploit SharePoint JWT Authentication Bypass After PoC Release

Microsoft SharePoint Flaws Expose Internet-Facing Servers to Spoofing and RCE Risk