CVE-2026-56164: 
vulnerability analysis and mitigation

CVE-2026-56164 is a missing authentication for critical function vulnerability (CWE-306) in Microsoft SharePoint Server that allows an unauthenticated remote attacker to elevate privileges over a network with no user interaction required. It was disclosed and patched on July 14, 2026, as part of Microsoft's record-breaking July 2026 Patch Tuesday. Affected products include Microsoft SharePoint Enterprise Server 2016 (before 16.0.5561.1001), SharePoint Server 2019 (before 16.0.10417.20175), and SharePoint Server Subscription Edition (before 16.0.19725.20434). NVD assigns a CVSS v3.1 base score of 9.8 (Critical), while Microsoft's own CNA scoring is 5.3 (Medium) (Microsoft MSRC, CISA KEV).

The vulnerability is rooted in missing authentication controls for a critical SharePoint function (CWE-306), meaning certain privileged operations can be invoked without any credential verification. An unauthenticated attacker can send crafted network requests to the vulnerable SharePoint endpoint to bypass authentication and escalate privileges — requiring no user interaction and exploitable with low attack complexity. A public Python-based PoC exploit (cve-2026-56164.py) has been released that automates the attack by targeting a SharePoint site URL, creating a persistent backdoor domain user, and adding it to the Farm Administrators group (GitHub PoC). The vulnerability has been chained with other SharePoint CVEs (CVE-2026-32201, CVE-2026-45659, CVE-2026-55040) in observed attack campaigns to achieve full remote code execution (Tenable Blog).

Successful exploitation grants an unauthenticated attacker administrative-level access to the SharePoint environment, with high impact to confidentiality, integrity, and availability. Attackers have been observed deploying web shells, stealing IIS machine keys (enabling persistent RCE even after patching), and creating backdoor administrative accounts for persistent access (Resecurity, CyberSecurityNews). The vulnerability enables lateral movement from the SharePoint server into broader Active Directory and enterprise network environments, and the ToolShell malware family has been confirmed to weaponize this CVE (Feedly Threat Intel).

CVE-2026-56164 is being actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on July 14, 2026, with a mandatory remediation due date of July 17, 2026 (CISA KEV). A functional, high-confidence Python PoC exploit is publicly available on GitHub that creates persistent backdoor admin accounts on targeted SharePoint servers (GitHub PoC). The ToolShell malware family has been confirmed to weaponize this vulnerability in active campaigns. The EPSS score is approximately 0.056 (5.6%), and CISA's SSVC assessment classifies exploitation as active and the vulnerability as automatable (CISA KEV).

1. Reconnaissance: Identify internet-facing Microsoft SharePoint Server 2016, 2019, or Subscription Edition instances using tools like Shodan, Censys, or Shadowserver data, targeting unpatched versions (e.g., SharePoint Server 2019 before 16.0.10417.20175).
2. Obtain PoC: Download or adapt the public Python exploit script (cve-2026-56164.py) from the sentinel-aidefense GitHub repository.
3. Trigger authentication bypass: Execute the exploit against the target: python3 cve-2026-56164.py -t https://target.sharepoint.site. The script sends crafted unauthenticated HTTP requests to a critical SharePoint function endpoint, bypassing authentication controls.
4. Privilege escalation: The exploit leverages the missing authentication to invoke privileged SharePoint administrative APIs, creating a new backdoor domain user account.
5. Establish persistence: The newly created account is added to the Farm Administrators group, granting full administrative control over the SharePoint farm.
6. Post-exploitation: Attackers deploy web shells for persistent remote access, steal IIS machine keys to enable future RCE even after patching, and pivot laterally into Active Directory and connected enterprise systems (GitHub PoC, Resecurity, CyberSecurityNews).

• Network: Unusual unauthenticated HTTP POST/GET requests to SharePoint administrative endpoints from external IPs; outbound connections from the SharePoint server to unknown external hosts; scanning activity targeting SharePoint login and admin pages.
• Logs: SharePoint ULS logs showing privilege escalation events or unexpected administrative API calls without prior authentication; IIS access logs with anomalous requests to /_api/ or /_layouts/ endpoints from unauthenticated sessions; Windows Security Event logs showing new domain user account creation (Event ID 4720) and group membership changes (Event ID 4728) by the SharePoint service account.
• File System: Unexpected ASPX web shell files in SharePoint web directories (e.g., _layouts, App_Data, or site collection directories); modified or newly created files in IIS root directories; evidence of IIS machine key (machineKey) extraction from web.config.
• Process: Unusual child processes spawned by the SharePoint or IIS worker process (w3wp.exe), such as cmd.exe, powershell.exe, net.exe, or whoami.exe; unexpected PowerShell execution with encoded commands originating from IIS.
• Active Directory: New domain user accounts created unexpectedly; accounts added to high-privilege groups (Farm Administrators, Domain Admins) without change management records (Resecurity, CyberSecurityNews).

Microsoft released security updates on July 14, 2026 addressing this vulnerability: SharePoint Enterprise Server 2016 should be updated to 16.0.5561.1001 or later; SharePoint Server 2019 to 16.0.10417.20175 or later; and SharePoint Server Subscription Edition to 16.0.19725.20434 or later (Microsoft MSRC). CISA mandated federal agencies apply patches by July 17, 2026, and issued a separate advisory urging SharePoint hardening (CISA KEV). As a defense-in-depth measure, organizations should restrict network access to SharePoint servers, rotate IIS machine keys after patching (as stolen keys can enable persistent RCE even post-patch), audit administrative accounts for unauthorized additions, and deploy web application firewall rules to detect exploitation attempts. Note that patching alone may not evict attackers who have already stolen machine keys or deployed web shells — forensic triage is recommended per CISA's BOD 26-04 guidance.

CISA issued an urgent alert on July 14, 2026 urging SharePoint hardening and added CVE-2026-56164 to the KEV catalog with a 3-day remediation deadline, reflecting the severity of active exploitation (CISA KEV). Security researchers and vendors including Tenable, Rapid7, CrowdStrike, Qualys, and Resecurity published detailed analyses and FAQ posts covering the SharePoint exploitation chain (Tenable Blog). The vulnerability received widespread media coverage as part of Microsoft's record-breaking July 2026 Patch Tuesday (570–622 CVEs), with outlets including The Register, SecurityWeek, BleepingComputer, and The Hacker News highlighting the SharePoint zero-days as the most critical items requiring immediate action. Community discussion on Reddit and security forums emphasized that patching alone is insufficient given the IIS machine key theft technique, with defenders urged to perform forensic triage on all exposed SharePoint servers.