CVE-2026-56164

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-56164 5.3

Microsoft · SharePoint Server · Added 2026-07-14 · Published 2026-07-14

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityMicrosoft SharePoint Server Missing Authentication for Critical Function Vulnerability

VendorMicrosoft

ProductSharePoint Server

Date added2026-07-14

Due date2026-07-17

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-306

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Descriptions

KEV: Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.

NVD: Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impactpartial

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days

Non-public timeline14 days

Forensic (public)Not required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-25 23:47 UTC

Wall time0.5s

Searches5

Component defaultunknown

Sources https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164
https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164
https://thehackernews.com/2026/07/microsoft-patches-record-622-flaws.html
https://cvereports.com/reports/CVE-2026-56164
https://github.com/sentinel-aidefense/CVE-2026-56164-EXP
https://www.sentinelone.com/vulnerability-database/cve-2026-56164/
https://www.cycognito.com/blog/emerging-threat-cve-2026-56164-sharepoint-server-privilege-escalation-via-missing-authentication/
https://www.resecurity.com/blog/article/from-web-request-to-domain-compromise-understanding-the-july-2026-sharepoint-attacks

Hunting hypothesis agent

Hunt for POST /_vti_bin/client.svc returning 200 without X-RequestDigest — exploit omits this header with routing values to bypass SPContext in UserProfiles, granting Farm Admin; stock IIS logs lack headers, need WAF or advanced logging.

Research details

ComponentMicrosoft.Office.Server.UserProfiles assembly — SOAP handler at /_vti_bin/client.svc bypasses X-RequestDigest validation when secondary routing headers are present, granting unauthenticated Farm Administrator access

PreconditionsNetwork access (HTTP/HTTPS) to an on-premises SharePoint Server instance; no authentication required; target must run SharePoint Server 2016 (before 16.0.5561.1001), SharePoint Server 2019 (before 16.0.10417.20175), or SharePoint Server Subscription Edition (before 16.0.19725.20434). The /_vti_bin/client.svc endpoint must be reachable from the attacker's network. agent

DeliveryNetwork (HTTP/HTTPS to /_vti_bin/client.svc); unauthenticated SOAP request with X-RequestDigest header omitted and specific routing headers present triggers the Microsoft.Office.Server.UserProfiles handler to bypass authentication and initialize an elevated administrative session, granting Farm Administrator privileges.

Public PoCyes

PoC URLs https://github.com/sentinel-aidefense/CVE-2026-56164-EXP Third-party repos; verify before use.

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164

Exploit notesThe sentinel-aidefense/CVE-2026-56164-EXP GitHub repo provides a functional unauthenticated EoP exploit concept targeting the SharePoint client service endpoint. The exploit sends a crafted SOAP payload to /_vti_bin/client.svc without the X-RequestDigest header but with specific routing headers that trigger the fallback to an elevated administrative session in the Microsoft.Office.Server.UserProfiles assembly. The vulnerable code path checks for the digest, finds it empty, inspects secondary routing parameters, and if satisfied, calls InitializeElevatedSecurityContext() instead of rejecting the request. The July 2026 patch removes the fallback pathway entirely. Actively exploited in the wild; CISA KEV listed July 14, 2026. CVSS attack complexity: LOW | MODERATE severity (CVSS 5.3), but operational impact is critical as it grants Farm Administrator privileges on internet-facing SharePoint instances.

SummaryMicrosoft SharePoint Server contains a missing authentication vulnerability (CWE-306) in the Microsoft.Office.Server.UserProfiles assembly's SOAP handler at /_vti_bin/client.svc. An unauthenticated remote attacker can send a crafted request omitting the X-RequestDigest header while including specific routing headers, causing the handler to bypass standard identity validation and initialize a highly privileged administrative session. This grants Site Collection Administrator or Farm Administrator access, enabling full control over site contents, configuration databases, and connected services. The vulnerability affects SharePoint Server 2016, 2019, and Subscription Edition. A functional PoC is publicly available and the vulnerability is actively exploited per CISA KEV.

Tia coverage

First reported2026-07-15

First exploit report2026-07-16

Exploit report → KEV2 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cve-2026-50522-new-sharepoint-rce-actively-exploited-to-steal-ma cve-2026-56164-sharepoint-privilege-escalation-exploited cve-2026-63520-microsoft-sharepoint-remote-code-execution-fixed microsoft-july-2026-patch-tuesday-record-622-cves-two-exploited microsoft-sharepoint-exploitation-fourth-kev-entry-tenable-confi swiss-government-sharepoint-breach-compromises-200-accounts warlock-ransomware-breach-sharepoint-in-water-telecom-operator-a

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.