← Back to Feed CACHED · 2026-10-06 18:46:42 · CACHE_KEY CVE-2026-56164
CVE-2026-56164 · CWE-306 · Disclosed 2026-07-14

Microsoft SharePoint Server Missing Authentication Privilege Escalation (Farm Administrator Takeover)

ASSESSED — NOISGATE
Vendor
—
—
—
Reassessed
—
—
—
Verdict: —
Do you agree?
01 · The Real Story

Microsoft left the farm gate unlocked and the keys in the tractor — and someone is already driving it through the field

CVE-2026-56164 is a missing-authentication flaw in on-premises Microsoft SharePoint Server (2016, 2019, and Subscription Edition) that lets a completely unauthenticated, remote attacker elevate privileges to Farm Administrator by sending crafted SOAP requests to /_vti_bin/client.svc/ProcessQuery. The vulnerable code path in Microsoft.Office.Server.UserProfiles fails to reject requests that omit the X-RequestDigest validation token; instead, when specific routing headers (including X-SharePoint-Authenticated: 1 and SPHomeBearerHint: farmadmin) are present, the server initializes an elevated security context and processes the request with system-level credentials. Affected builds are SharePoint 2016 below 16.0.5561.1001, SharePoint 2019 below 16.0.10417.20175, and Subscription Edition below 16.0.19725.20434. SharePoint Online is not affected.

Microsoft rated this 5.3 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), measuring only the narrow direct-integrity delta of the auth bypass itself. The NVD independently scored it 9.8 CRITICAL, capturing the full privilege-escalation blast radius. Microsoft's score is misleading to the point of being dangerous. The flaw was discovered by Mandiant and Google FLARE during active incident response — not through routine research — which means attackers were already using it before a patch existed. CISA added it to KEV on disclosure day and gave federal agencies a 3-day remediation deadline. A weaponized Python PoC toolkit (sam00/POC-CVE-2026-56164-exploit) is public on GitHub with scan, enumerate, elevate, and execute modes. In observed campaigns, attackers chain this CVE with CVE-2026-32201 (spoofing) and CVE-2026-45659 (deserialization RCE) to move from unauthenticated web request to domain compromise. The vendor severity is, bluntly, wrong.

"Vendor says 5.3 MEDIUM. Reality: unauthenticated farm-admin takeover under active exploitation. This is a 9.8."
02 · The Attack Path

6 steps from start to impact.

STEP 01

Target identification

The attacker searches Shodan, Censys, or FOFA for SharePoint-specific HTTP response headers and /_layouts/15/ paths. Certificate transparency logs and DNS enumeration further narrow the list to on-prem instances. Approximately 10,000 SharePoint servers are internet-exposed per Shadowserver, with over half in North America.
Conditions required:
  • Internet-facing SharePoint instance, or internal network access post-initial-compromise
Where this breaks in practice:
  • Not all SharePoint farms are internet-facing — many are internal-only behind corporate VPN or reverse proxies
Detection/coverage: Shodan/Censys dorks are passive; GreyNoise may flag scanning activity targeting /_vti_bin/ and /_layouts/
STEP 02

Authentication bypass via missing auth check

The attacker sends a POST request to /_vti_bin/client.svc/ProcessQuery without the X-RequestDigest header while injecting routing headers (X-SharePoint-Authenticated: 1, X-SP-RequestRights: FullControl, SPHomeBearerHint: farmadmin). The Microsoft.Office.Server.UserProfiles assembly fails to reject the unauthenticated request and instead initializes an elevated security context. The sam00/POC-CVE-2026-56164-exploit Python toolkit automates this step. Zero friction — no credentials, no interaction, low complexity.
Conditions required:
  • Network reachability to the SharePoint web front-end on port 80/443
Where this breaks in practice:
  • None — this is unauthenticated and requires no user interaction
Detection/coverage: Microsoft AMSI signatures: Exploit:Script/ToolPaneAuthBypass.A and Exploit:Script/ToolPaneAuthBypass.C. WAF rules matching POST to /_vti_bin/client.svc/ProcessQuery without X-RequestDigest.
STEP 03

Elevation to Farm Administrator

With the elevated context, the attacker uses CSOM or SOAP payloads to enumerate site collections, users, and farm configuration, then promotes an attacker-controlled (or existing) account to Farm Administrator. The PoC's elevate mode automates this. From this point the attacker controls the entire SharePoint farm: all sites, all documents, all service accounts.
Conditions required:
  • Successful authentication bypass (step 2)
Where this breaks in practice:
  • None — logical consequence of step 2
Detection/coverage: Audit Farm Administrator group membership changes. Unexpected SPFarm.CurrentUserIsAdministrator() calls in ULS logs. SIEM correlation on SharePoint admin-change events.
STEP 04

Web shell deployment and persistence

The attacker deploys ASP.NET web shells to directories like C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\ (e.g., spinstall0.aspx). Shells are password-protected and XOR-encrypted to evade static analysis. Microsoft Defender detects known variants as Backdoor:MSIL/LeakFang.A!dha.
Conditions required:
  • Farm Administrator access (step 3)
Where this breaks in practice:
  • Microsoft Defender / AMSI in Full Mode may detect and quarantine known web shell variants
  • EDR monitoring w3wp.exe child processes may alert
Detection/coverage: File integrity monitoring on SharePoint web roots. MDAV alert Backdoor:MSIL/LeakFang.A!dha. New .aspx/.ashx/.dll files in _layouts directories created outside change windows.
STEP 05

IIS machine key theft and ViewState forgery

The attacker reads validationKey and decryptionKey from web.config or uses reflective .NET code through the web shell. Stolen machine keys enable forging malicious ViewState payloads with ysoserial.net, providing persistent arbitrary code execution that survives web shell cleanup. Attackers may also install malicious IIS modules in applicationHost.config.
Conditions required:
  • Web shell access on a SharePoint WFE (step 4)
Where this breaks in practice:
  • Machine key rotation (if performed) invalidates stolen keys
  • IIS module installation triggers Event ID 29
Detection/coverage: IIS Event ID 29 (new module), Event ID 50 (config changes). Monitor applicationHost.config modifications. Detect Assembly.Load / System.Reflection.Emit activity from w3wp.exe.
STEP 06

Lateral movement to domain compromise

The SharePoint farm service account typically has SQL Server access and Active Directory privileges. The attacker pivots through SQL relay attacks, credential harvesting via PowerShell, and leverages the farm account's AD trust to move laterally. Data is staged in hidden SharePoint libraries and exfiltrated via HTTPS. The observed end-state is full domain compromise.
Conditions required:
  • Persistent access to SharePoint farm (steps 4-5)
  • Farm service account with AD/SQL access (default in most deployments)
Where this breaks in practice:
  • Network segmentation between SharePoint, SQL, and AD tiers
  • EDR on domain controllers detecting lateral movement
  • Credential tiering / PAW architecture
Detection/coverage: w3wp.exe spawning cmd.exe, powershell.exe, rundll32.exe, certutil.exe. SQL audit logs showing unexpected farm-account queries. AD audit logs showing service account authentication from SharePoint WFE IPs.
03 · Compensating Control

1
CRITICAL 9.8→IGNORE 0.0
SEVERITY REDUCED
Apply the July 2026 SharePoint security updates immediately — Install KB5002882 (Subscription Edition), KB5002883 + KB5002885 (2019), or KB5002891 + KB5002892 (2016). Both the STS and WSSLOC packages are required even for English-only farms. This is active exploitation with a public PoC — deploy within the noisgate CRITICAL mitigation SLA of 3 days, though given KEV status, hours is the correct target. Verify builds reach 16.0.19725.20434 (SE), 16.0.10417.20175 (2019), or 16.0.5561.1001 (2016) on every WFE and app server in the farm.
2
CRITICAL 9.8→HIGH 7.0
SEVERITY REDUCED
Block unauthenticated external access to SharePoint immediately — Place SharePoint behind an authenticated Layer 7 reverse proxy or VPN gateway. Remove direct internet exposure. Block external access to /_vti_bin/, /_layouts/, and Central Administration. This eliminates the unauthenticated-remote attack vector for internet-sourced threats while you patch. Deploy within hours — this is the fastest compensating control and buys time for the patching process.
3
CRITICAL 9.8→HIGH 7.5
SEVERITY REDUCED
Enable AMSI integration in Full Mode with Request Body Scan — SharePoint's AMSI integration detects exploitation attempts via signatures Exploit:Script/ToolPaneAuthBypass.A and Exploit:Script/ToolPaneAuthBypass.C. Run Test-DefenderAndAmsiWorkProperly to verify. This is defense-in-depth — it can detect and block known exploit payloads but will not stop novel bypass variants. Deploy within the 3-day CRITICAL mitigation SLA.
4
CRITICAL 9.8→HIGH 8.0
SEVERITY REDUCED
Hunt for pre-patch compromise indicators — Before and after patching, collect IIS logs, ULS logs, Windows event logs, and EDR telemetry from every WFE. Search for: unexpected Farm Administrator additions, new .aspx/.ashx/.dll files in TEMPLATE\LAYOUTS, w3wp.exe spawning cmd.exe/powershell.exe, MDAV alert Backdoor:MSIL/LeakFang.A!dha, and IIS Event ID 29 (new module). If any indicators are found, treat the farm as compromised and escalate to full IR. Patches have been available since July 14 — any unpatched farm should be presumed compromised.
5
CRITICAL 9.8→HIGH 8.0
SEVERITY REDUCED
Rotate IIS machine keys across the entire farm — If machine keys were harvested pre-patch, attackers retain persistent code execution via ViewState forgery even after patching. Generate new validationKey and decryptionKey values, deploy to all WFEs simultaneously, and recycle app pools. This breaks ViewState-based persistence. Follow Microsoft's machine key rotation guidance for SharePoint farms.
6
CRITICAL 9.8→MEDIUM 6.5
SEVERITY REDUCED
Segment SharePoint farm from AD and SQL tiers — Restrict network flows so SharePoint WFEs cannot directly reach domain controllers or SQL servers except on required ports. This limits lateral movement from a compromised farm. Deploy firewall rules or microsegmentation within the noisgate 3-day CRITICAL mitigation SLA. Does not fix the vulnerability but constrains the blast radius of a successful chain.
What doesn't work
  • MFA on SharePoint — The vulnerability bypasses the authentication layer entirely. MFA protects the authentication function; this bug exploits a code path that *never invokes* the authentication function. MFA is irrelevant.
  • SharePoint claims-based authorization / granular permissions — Claims evaluation occurs downstream of authentication. When the attacker bypasses auth and operates as Farm Administrator, all permissions are moot. Tightening site-level permissions has zero effect.
  • TLS/SSL hardening — The exploit works over HTTPS just as well as HTTP. Transport-layer encryption protects data in transit; it does not validate whether the caller should be executing privileged SOAP requests.
  • Windows Firewall on the SharePoint server — The attack arrives on the same ports (80/443) as legitimate SharePoint traffic. Port-based filtering cannot distinguish exploit payloads from normal CSOM requests.
04 · Intelligence Metadata

The supporting signals.

In-the-wild exploitationConfirmed active. Discovered by Mandiant/Google FLARE during live incident response, not routine research. CISA advisory 2026-07-14 confirms exploitation across finance, healthcare, government, and energy sectors. Attackers chain CVE-2026-56164 with CVE-2026-32201 (spoofing) and CVE-2026-45659 (deserialization RCE) — same fingerprint as the ToolShell campaign from 2025.
Proof-of-conceptPublic and weaponized. GitHub repo sam00/POC-CVE-2026-56164-exploit — Python 3.8+ toolkit with five modes: detect, enumerate, elevate, execute, and full chain. Includes scan.py, exploit.py, and payload_gen.py. Generates CSOM/SOAP payloads with bypass headers automatically.
EPSS0.01011 (~1.0% probability of exploitation in next 30 days). This is a model lag artifact — the CVE is KEV-listed and under confirmed active exploitation with a public PoC. Do not use EPSS to deprioritize this vulnerability.
CISA KEVListed July 14, 2026 (same day as disclosure). Federal remediation deadline: July 17, 2026 (3-day window). KEV catalog entry.
CVSS scoringMicrosoft: 5.3 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) — measures only narrow direct-integrity delta. NVD: 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — captures full privilege-escalation impact. The 4.5-point gap is one of the widest vendor-vs-NVD discrepancies in 2026.
Affected versionsSharePoint Enterprise Server 2016 (< 16.0.5561.1001), SharePoint Server 2019 (< 16.0.10417.20175), SharePoint Server Subscription Edition (< 16.0.19725.20434). SharePoint Online is NOT affected. Note: SP 2016 and SP 2019 reached end of extended support on July 14, 2026 — the same day patches shipped.
Fixed versionsSE: KB5002882 → 16.0.19725.20434 · 2019: KB5002883 + KB5002885 → 16.0.10417.20175 · 2016: KB5002891 + KB5002892 → 16.0.5561.1001. Both STS (language-independent) and WSSLOC (language-dependent) packages are required, even for English-only farms.
Exposure dataShadowserver Foundation tracks ~10,000 internet-exposed SharePoint servers globally, with 800+ confirmed unpatched against the July 2026 SharePoint CVE cluster. Over half are in North America. Attackers actively enumerate targets via Shodan/Censys queries for SharePoint HTTP headers and /_layouts/15/ paths.
Disclosure dateJuly 14, 2026 (Patch Tuesday). Exploited as a zero-day prior to disclosure. KEV-listed the same day.
Reporting researcherMandiant incident responders and Google FLARE team. Discovery during active IR against finance/government targets, per CyCoGnito and Tenable reporting.

Sources.

  1. CISA Alert — SharePoint Hardening After New Exploitations
  2. CISA KEV Catalog Addition (July 14, 2026)
  3. Tenable FAQ — CVE-2026-32201, CVE-2026-45659, CVE-2026-56164
  4. CyCoGnito — Emerging Threat Analysis
  5. Resecurity — From Web Request to Domain Compromise
  6. Penligent — CVE-2026-56164 Deep Dive and KEV Response
  7. sam00/POC-CVE-2026-56164-exploit (GitHub PoC)
  8. ThreatFrontier — SharePoint Zero-Day Under Active Attack
05 · The Call

Final Verdict
↑ UPGRADED to CRITICAL (9.8/10)

Why this verdict

  • Unauthenticated remote exploit with zero friction: AV:N/AC:L/PR:N/UI:N — every precondition is met by default on any reachable SharePoint instance. There is no authentication step to bypass, no user to phish, no complexity gate to clear. This is as frictionless as exploitation gets.
  • Confirmed active exploitation as a zero-day: Mandiant/FLARE discovered this during live IR, meaning attackers weaponized it *before* a patch existed. CISA gave a 3-day federal remediation window — the shortest standard window — signaling emergency-tier urgency. The EPSS model has not caught up; ignore the 0.01 score.
  • Public weaponized PoC lowers the bar to script-kiddie level: The sam00/POC-CVE-2026-56164-exploit toolkit automates the full chain from detection to command execution. Any attacker with Python 3.8 and network access can elevate to Farm Administrator. This is not a theoretical research PoC — it is a turnkey exploitation toolkit.
  • Chain to domain compromise is documented and repeatable: Observed campaigns combine this CVE with CVE-2026-32201 and CVE-2026-45659 to achieve web shell deployment → IIS machine key theft → ViewState forgery → lateral movement → domain compromise. The farm service account's inherent AD/SQL access makes the pivot trivial in default configurations.
  • Role multiplier — SharePoint is a canonically high-value enterprise component: On-premises SharePoint Server is, by definition, a high-trust collaboration platform holding sensitive documents, PII, IP, and regulated data. The farm service account connects to SQL and Active Directory. ~100% of on-prem SharePoint installs occupy the 'high-value role' tier — they are not workstations or dev sandboxes. The demonstrated attack chain ends in domain compromise (farm admin → machine key theft → AD lateral movement → DA). Per the high-value-role floor rule: the bug is IN a canonically high-value component where ≥10% of installs occupy the high-value role by definition, and the outcome is domain/fleet compromise → verdict floor is CRITICAL.
  • ~10,000 internet-exposed instances amplify blast radius: Shadowserver data shows meaningful external exposure. Even internal-only farms are reachable post-initial-compromise, and the chaining with CVE-2026-32201 provides additional entry vectors. The 'requires internal access' friction point does NOT break the CRITICAL floor because the majority of on-prem SharePoint deployments are reachable from the corporate network, which is exactly where post-phishing attackers land.
  • Microsoft's 5.3 vendor score is indefensible: The vendor scored C:N/I:L/A:N, treating the auth bypass as a minor integrity issue. This ignores the elevation to Farm Administrator (C:H/I:H/A:H in practice), the documented chain to domain compromise, and the confirmed active exploitation. The NVD's 9.8 is the correct assessment.

Why not higher?

The reassessed score of 9.8 is already at the practical ceiling of the CVSS scale. The only theoretical mitigating factor is that SharePoint Online is unaffected, meaning pure-cloud organizations have zero exposure. The on-premises installed base has been declining as Microsoft pushes SharePoint Online adoption, but remaining on-prem deployments disproportionately represent government, regulated industries, and data-sovereignty-sensitive environments — precisely the highest-value targets.

Why not lower?

An unauthenticated, zero-interaction, network-reachable exploit under confirmed active zero-day exploitation with a weaponized public PoC, KEV listing with a 3-day federal deadline, and a demonstrated chain to domain compromise through a canonically high-value enterprise platform leaves absolutely no room for downgrade. The SharePoint high-value-role floor alone guarantees CRITICAL. Even if one were to argue 'most deployments are internal-only,' the post-initial-access reachability of internal SharePoint plus the chaining evidence means the friction reduction is negligible.

06 · Verification

Crowdsourced verification payload.

Run this script on each SharePoint server in the farm (every WFE and app server). Requires the SharePoint Management Shell snap-in and local Administrator privileges. Invoke as: .\Check-CVE-2026-56164.ps1

noisgate-verify.ps1
POWERSHELLREAD-ONLYSAFE
#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Checks whether this SharePoint server is patched against CVE-2026-56164.
.DESCRIPTION
    Reads the farm build version and compares it against the fixed builds
    for SharePoint Server 2016, 2019, and Subscription Edition.
    Outputs VULNERABLE, PATCHED, or UNKNOWN.
.NOTES
    Run on every SharePoint server (WFE + App) in the farm.
    Requires: SharePoint Management Shell, local Administrator.
    Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'

try {
    # Load SharePoint snap-in
    if (-not (Get-PSSnapin -Name Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue)) {
        Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop
    }

    $farm = Get-SPFarm -ErrorAction Stop
    $currentBuild = $farm.BuildVersion
    $cv = [version]$currentBuild.ToString()

    # Fixed builds per edition (from Microsoft July 2026 Patch Tuesday)
    # SE:   16.0.19725.20434  (KB5002882)
    # 2019: 16.0.10417.20175  (KB5002883 + KB5002885)
    # 2016: 16.0.5561.1001    (KB5002891 + KB5002892)

    $edition = 'Unknown'
    $fixedBuild = $null
    $kbs = ''

    if ($cv.Build -ge 17000) {
        $edition = 'Subscription Edition'
        $fixedBuild = [version]'16.0.19725.20434'
        $kbs = 'KB5002882'
    } elseif ($cv.Build -ge 10000) {
        $edition = '2019'
        $fixedBuild = [version]'16.0.10417.20175'
        $kbs = 'KB5002883 + KB5002885'
    } elseif ($cv.Build -ge 4000) {
        $edition = '2016'
        $fixedBuild = [version]'16.0.5561.1001'
        $kbs = 'KB5002891 + KB5002892'
    }

    if ($edition -eq 'Unknown') {
        Write-Host "UNKNOWN - Cannot determine SharePoint edition from build $cv"
        Write-Host "         Verify manually against Microsoft advisory."
        exit 2
    }

    Write-Host "=== CVE-2026-56164 Check ==="
    Write-Host "Server:        $($env:COMPUTERNAME)"
    Write-Host "Edition:       SharePoint Server $edition"
    Write-Host "Current build: $cv"
    Write-Host "Fixed build:   $fixedBuild ($kbs)"
    Write-Host ""

    if ($cv -ge $fixedBuild) {
        Write-Host "PATCHED - Build $cv meets or exceeds the fix for CVE-2026-56164."
        exit 0
    } else {
        Write-Host "VULNERABLE - Build $cv is below the fixed build $fixedBuild."
        Write-Host "             Apply $kbs immediately. This CVE is under active exploitation."
        exit 1
    }
}
catch {
    Write-Host "UNKNOWN - Error retrieving SharePoint build information: $($_.Exception.Message)"
    Write-Host "         Ensure this server has the SharePoint Management Shell installed."
    exit 2
}