Loading vulnerability…
Unauthenticated Privilege Escalation in Microsoft SharePoint Server
CVE-2026-56164 is a missing-authentication vulnerability in on-premises Microsoft SharePoint Server. A critical function is accessible without proper authentication, allowing a remote, unauthenticated attacker to elevate privileges, potentially obtaining site-user or administrator access. Affected products include SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Exploitation is classified as low complexity and has occurred in the wild. The vulnerability can be chained with separate SharePoint code-execution flaws; arbitrary code execution is not established as a standalone capability of this vulnerability. SharePoint Online and Microsoft 365 are unaffected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises SharePoint authentication boundaries and enables unauthorized access with elevated privileges. Depending on the privileges obtained, attackers may access protected information or perform administrative operations. Observed attack chains involving this vulnerability and other SharePoint flaws have enabled server compromise, IIS machine-key theft, persistence, and malware deployment. Those downstream outcomes depend on additional vulnerabilities or post-exploitation actions.
If you can’t patch tonight, do this now.
Until updates are applied, remove unnecessary direct internet exposure and restrict SharePoint access to trusted networks or an authenticated reverse proxy. Block external access to Central Administration. Enable SharePoint AMSI integration and supported IIS worker-process scanning, using Full request-body scanning where available to detect malicious POST requests. Monitor for anomalous SharePoint requests, suspicious IIS worker-process activity, unexpected IIS modules, and machine-key access. These controls reduce exposure but do not replace patching.
Patch, then assume compromise.
Apply Microsoft's July 14, 2026 security updates or superseding updates to every affected SharePoint farm server. Fixed builds are 16.0.5561.1001 for SharePoint Enterprise Server 2016, 16.0.10417.20175 for SharePoint Server 2019, and 16.0.19725.20434 for SharePoint Server Subscription Edition. Investigate exposed deployments for prior compromise. If compromise is identified, remove web shells, malicious IIS modules, and machine-key-harvesting artifacts before rotating IIS/ASP.NET machine keys; reset compromised credentials. Patching alone does not remove persistence established through a broader exploit chain.
1 exploit validated by Mallory's analysis. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
181 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.