{"id":"sharepoint-missing-authentication-attacks-jul-2026","category":"patch","status":"closed","title":"Microsoft SharePoint Server missing-authentication flaw CVE-2026-56164 used in attacks; fixes available","tldr":"Attackers are exploiting CVE-2026-56164 in self-hosted Microsoft SharePoint Server. Fixes cover 2016, 2019 and Subscription Edition. Ask IT to patch, check for compromise and migrate unsupported 2016/2019 installations.","summary":"CVE-2026-56164 is a missing authentication check in Microsoft SharePoint Server that lets an attacker gain additional privileges over a network without prior authentication. It affects organisations running SharePoint Enterprise Server 2016, Server 2019 or Subscription Edition on their own infrastructure. Microsoft disclosed it on 14 July, when CISA added it to its catalogue of vulnerabilities used in attacks. Fixes are available for all three affected editions: 16.0.5561.1001, 16.0.10417.20175 and 16.0.19725.20434 respectively. Microsoft's record, updated on 8 October, rates the flaw medium at 5.3. SharePoint 2016 and 2019 reached the end of extended support on 14 July, so organisations should also migrate to a supported edition. Administrators should check for compromise alongside patching. The reviewed sources do not establish the first attack date, victim count or that exploitation has ended.","action":"If your business or family office runs its own SharePoint Server, ask its IT provider to install the latest security updates and confirm the fixed builds below. Ask them to check for compromise and move SharePoint 2016 or 2019 to a supported edition. There is no phone or home-computer update for this server flaw.","product":"Microsoft SharePoint Server","audience":"work","severity":"medium","patch":"patched","exploited":true,"cves":["CVE-2026-56164"],"tags":["microsoft","sharepoint","authentication-bypass","privilege-escalation","actively-exploited"],"affected":["Microsoft SharePoint Enterprise Server 2016: 16.0.0 before 16.0.5561.1001","Microsoft SharePoint Server 2019: 16.0.0 before 16.0.10417.20175","Microsoft SharePoint Server Subscription Edition: 16.0.0 before 16.0.19725.20434"],"fixed":["Microsoft SharePoint Enterprise Server 2016: 16.0.5561.1001","Microsoft SharePoint Server 2019: 16.0.10417.20175","Microsoft SharePoint Server Subscription Edition: 16.0.19725.20434"],"matches":[],"sources":[{"kind":"advisory","title":"Microsoft-issued CVE record: SharePoint Server Elevation of Privilege Vulnerability","url":"https://www.cve.org/CVERecord?id=CVE-2026-56164","by":"Microsoft","date":"2026-10-08"},{"kind":"advisory","title":"AL26-017: Critical vulnerabilities impacting Microsoft SharePoint Server","url":"https://www.cyber.gc.ca/en/alerts-advisories/al26-017-critical-vulnerabilities-impacting-microsoft-sharepoint-server-cve-2026-56164-cve-2026-55040-cve-2026-58644?wbdisable=true","by":"Canadian Centre for Cyber Security","date":"2026-07-15"},{"kind":"advisory","title":"Microsoft Releases July 2026 Security Updates","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4814?trk=article-ssr-frontend-pulse_little-text-block","by":"NHS England","date":"2026-07-15"},{"kind":"news","title":"CISA warns admins to patch actively exploited SharePoint flaws","url":"https://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-patch-actively-exploited-sharepoint-flaws/","by":"BleepingComputer","date":"2026-07-15"}],"started":"2026-07-14","closed":"2026-10-08","created":"2026-11-03T22:19:52.161Z","updated":"2026-11-03T22:19:52.161Z","cve_notes":[{"cve":"CVE-2026-56164","name":"Missing authentication in SharePoint Server","what":"A missing authentication check for a critical SharePoint Server function lets an attacker gain additional privileges over a network without first authenticating.","severity":"medium","cvss":5.3}],"timeline":[{"at":"2026-10-08","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Microsoft's CVE record was updated. It lists the same three affected editions and version cut-offs, and rates the flaw medium with a CVSS score of 5.3.","url":"https://www.cve.org/CVERecord?id=CVE-2026-56164","by":"Microsoft","patch":null},{"at":"2026-07-15","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"NHS England confirmed detected exploitation and urged organisations to apply Microsoft's updates. It also warned that SharePoint Server 2016 and 2019 had reached the end of extended support on 14 July.","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4814?trk=article-ssr-frontend-pulse_little-text-block","by":"NHS England","patch":null},{"at":"2026-07-14","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-56164 to its Known Exploited Vulnerabilities catalogue. Canada's Cyber Centre also confirmed that Microsoft was aware of exploitation.","url":"https://www.cyber.gc.ca/en/alerts-advisories/al26-017-critical-vulnerabilities-impacting-microsoft-sharepoint-server-cve-2026-56164-cve-2026-55040-cve-2026-58644?wbdisable=true","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-07-14","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Microsoft disclosed CVE-2026-56164 and released July security updates. Fixed builds are 16.0.5561.1001 for SharePoint 2016, 16.0.10417.20175 for 2019 and 16.0.19725.20434 for Subscription Edition.","url":"https://www.cyber.gc.ca/en/alerts-advisories/al26-017-critical-vulnerabilities-impacting-microsoft-sharepoint-server-cve-2026-56164-cve-2026-55040-cve-2026-58644?wbdisable=true","by":"Canadian Centre for Cyber Security","patch":"patched"}],"url":"https://hard.fyi/live/sharepoint-missing-authentication-attacks-jul-2026/","json":"https://hard.fyi/api/live?id=sharepoint-missing-authentication-attacks-jul-2026"}