Missing authentication for critical function in Microsoft Office SharePoint

CVE-2026-56164 is a missing authentication for a critical function (CWE-306) in on-premises Microsoft SharePoint Server. An unauthenticated remote attacker sends crafted requests to a SharePoint endpoint that should have required auth and gets to invoke privileged functionality without ever presenting a credential. Affected products include SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 — every currently supported on-prem SKU. SharePoint Online (M365) is not affected.

The vendor score of 5.3 / MEDIUM with C:N/I:L/A:N badly understates the reality. CISA has confirmed active in-the-wild exploitation as part of the July 2026 Patch Tuesday zero-day cluster, and public reporting shows chains that pivot from this bug into privileged access on the SharePoint farm — which in most enterprises holds regulated documents, links to the KDC via the farm service account, and often sits adjacent to ADFS. The CVSS vector treats the primary impact as spoofing / low-integrity, but the exploited chain lands closer to unauthenticated privilege escalation on a high-value identity-adjacent server. This is a CRITICAL in practice.

Why this verdict

• Active exploitation confirmed — CISA's July 14 alert states threat actors are already using this to gain unauthorized access to on-prem SharePoint. Vendor CVSS is a paper score; exploitation is the ground truth.
• Unauthenticated, network-reachable, no user interaction — AV:N/AC:L/PR:N/UI:N. Anyone who can reach the HTTP listener can trigger it. No friction on the attacker side.
• Role multiplier: SharePoint farm as document/identity-adjacent server — chain succeeds and blast radius is farm-wide code execution as the service account, followed by lateral movement into AD, SQL, and file shares. This is the canonical high-value role for the affected component (≥50% of installs occupy this role by definition), which sets the verdict floor at CRITICAL.
• Vendor score understates impact — Microsoft scored the isolated spoofing/low-integrity primitive (C:N/I:L/A:N). The exploited chain observed by responders reaches code execution and data theft. Talos and third parties are treating it as a zero-day that must be patched immediately.
• Partial mitigation exists but is insufficient — Microsoft explicitly says AMSI Full mode is a stopgap, not a fix. That is a vendor signaling that the compensating control does not fully close the hole.

Why not higher?

There is no higher bucket than CRITICAL. Score is capped at 9.3 rather than 10.0 because exploitation currently requires reaching the SharePoint listener — organizations with SharePoint fully internal and behind MFA-gated VPN reduce the attacker population meaningfully.

Why not lower?

Cannot drop below CRITICAL: the bug is unauthenticated, network-reachable, actively exploited, and the affected component is canonically a high-value-role server. Downgrading past the CRITICAL floor would require evidence that <1% of installs occupy the farm role — the opposite is true.

1. Apply the July 2026 SharePoint CU immediately — This is the only complete fix. Per noisgate mitigation SLA for CRITICAL with active exploitation: patch within hours, not days. Test in a staging farm only if you can complete it inside 24 hours; otherwise patch prod first and roll back on failure.
2. Enable AMSI integration in Full mode on every SharePoint server — Microsoft's documented partial mitigation. Set SharePoint Central Admin → Security → AMSI Integration → Enable and set Request Body Scan mode to Full. Deploy within 3 days if patching is somehow blocked. Requires Defender AV or compatible AMSI provider with current signatures.
3. Rotate SharePoint MachineKey after patching — Assume the MachineKey is compromised if the farm was internet-facing before patch. Use Set-SPMachineKey and restart IIS across the farm. Failure to rotate leaves a forged-VIEWSTATE persistence path even after the CU is applied.
4. Pull SharePoint off the public internet if you can — Front with a reverse proxy that requires pre-authentication (Entra Application Proxy, F5 APM, Netscaler with SAML). Removes the unauthenticated attacker population entirely.
5. Hunt for prior compromise — Review IIS logs since 2026-06-01 for unauthenticated POSTs to _layouts/15/ and _api/ endpoints, w3wp.exe spawning cmd/powershell, unexpected files in LAYOUTS, and out-of-cycle service account logons. Sigma rules from Talos and Elastic already published.

Run on each SharePoint Server in the farm as a local administrator from an elevated PowerShell prompt. Invoke: .\Check-CVE-2026-56164.ps1. Outputs VULNERABLE, PATCHED, or UNKNOWN and exits with 1, 0, or 2 respectively. Requires the SharePoint PowerShell snap-in loaded.

#requires -RunAsAdministrator
# Check-CVE-2026-56164.ps1
# Detects whether SharePoint Server has the July 2026 CU addressing CVE-2026-56164

$ErrorActionPreference = 'Stop'

# Minimum patched builds per SKU (July 2026 CU)
$patched = @{
    'SubscriptionEdition' = [Version]'16.0.17928.20000'
    '2019'                = [Version]'16.0.10417.20027'
    '2016'                = [Version]'16.0.5513.10000'
}

try {
    if (-not (Get-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue)) {
        Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop
    }

    $farm = Get-SPFarm
    $build = [Version]$farm.BuildVersion
    Write-Host "Detected SharePoint build: $build"

    # Detect SKU
    $sku = switch ($build.Major, $build.Minor, $build.Build) {
        { $build.Build -ge 17000 } { 'SubscriptionEdition'; break }
        { $build.Build -ge 10000 -and $build.Build -lt 17000 } { '2019'; break }
        { $build.Build -ge 4000  -and $build.Build -lt 10000 } { '2016'; break }
        default { $null }
    }

    if (-not $sku) {
        Write-Host 'UNKNOWN - unrecognized SharePoint SKU (2013 or earlier is out of support and unpatched)'
        exit 2
    }

    $min = $patched[$sku]
    if ($build -ge $min) {
        Write-Host "PATCHED - build $build >= required $min for $sku"
        exit 0
    } else {
        Write-Host "VULNERABLE - build $build < required $min for $sku (CVE-2026-56164)"
        exit 1
    }
} catch {
    Write-Host "UNKNOWN - error: $($_.Exception.Message)"
    exit 2
}

Sources

1. NVD - CVE-2026-56164
2. CISA Alert - SharePoint Hardening After New Exploitations
3. CISA Known Exploited Vulnerabilities Catalog
4. BleepingComputer - Microsoft July 2026 Patch Tuesday
5. The Hacker News - Microsoft Patches Record 622 Flaws
6. Cisco Talos - July 2026 Patch Tuesday Snort Rules
7. Zero Day Initiative - July 2026 Security Update Review
8. Windows Forum - July 2026 Patch Tuesday AD FS and SharePoint Zero-Days