NewsCompaniesFlawsGuides
Get the app
MediumFixedBeing used in attacksClosedUpdated

Microsoft SharePoint Server missing-authentication flaw CVE-2026-56164 used in attacks; fixes available

Attackers are exploiting CVE-2026-56164 in self-hosted Microsoft SharePoint Server. Fixes cover 2016, 2019 and Subscription Edition. Ask IT to patch, check for compromise and migrate unsupported 2016/2019 installations.

What to do

If your business or family office runs its own SharePoint Server, ask its IT provider to install the latest security updates and confirm the fixed builds below. Ask them to check for compromise and move SharePoint 2016 or 2019 to a supported edition. There is no phone or home-computer update for this server flaw.

What’s happening

CVE-2026-56164 is a missing authentication check in Microsoft SharePoint Server that lets an attacker gain additional privileges over a network without prior authentication. It affects organisations running SharePoint Enterprise Server 2016, Server 2019 or Subscription Edition on their own infrastructure. Microsoft disclosed it on 14 July, when CISA added it to its catalogue of vulnerabilities used in attacks. Fixes are available for all three affected editions: 16.0.5561.1001, 16.0.10417.20175 and 16.0.19725.20434 respectively. Microsoft's record, updated on 8 October, rates the flaw medium at 5.3. SharePoint 2016 and 2019 reached the end of extended support on 14 July, so organisations should also migrate to a supported edition. Administrators should check for compromise alongside patching. The reviewed sources do not establish the first attack date, victim count or that exploitation has ended.

What
Flaw
Affects
Microsoft SharePoint Server
Affected
Microsoft SharePoint Enterprise Server 2016: 16.0.0 before 16.0.5561.1001
Microsoft SharePoint Server 2019: 16.0.0 before 16.0.10417.20175
Microsoft SharePoint Server Subscription Edition: 16.0.0 before 16.0.19725.20434
Fixed in
Microsoft SharePoint Enterprise Server 2016: 16.0.5561.1001
Microsoft SharePoint Server 2019: 16.0.10417.20175
Microsoft SharePoint Server Subscription Edition: 16.0.19725.20434
CVE
CVE-2026-56164
Since
14 July 2026
Closed
8 Oct 2026

Timeline

  1. Update

    Microsoft's CVE record was updated. It lists the same three affected editions and version cut-offs, and rates the flaw medium with a CVSS score of 5.3.

  2. Update

    NHS England confirmed detected exploitation and urged organisations to apply Microsoft's updates. It also warned that SharePoint Server 2016 and 2019 had reached the end of extended support on 14 July.

  3. CISA added

    CISA added CVE-2026-56164 to its Known Exploited Vulnerabilities catalogue. Canada's Cyber Centre also confirmed that Microsoft was aware of exploitation.

  4. New fixFixed

    Microsoft disclosed CVE-2026-56164 and released July security updates. Fixed builds are 16.0.5561.1001 for SharePoint 2016, 16.0.10417.20175 for 2019 and 16.0.19725.20434 for Subscription Edition.

Sources

  1. Microsoft-issued CVE record: SharePoint Server Elevation of Privilege VulnerabilityMicrosoft · 8 Oct 2026
  2. AL26-017: Critical vulnerabilities impacting Microsoft SharePoint ServerCanadian Centre for Cyber Security · 15 July 2026
  3. Microsoft Releases July 2026 Security UpdatesNHS England · 15 July 2026
  4. CISA warns admins to patch actively exploited SharePoint flawsBleepingComputer · 15 July 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from July 2026 · JSON · RSS