Microsoft: CISA Warns of Microsoft SharePoint Server Vulnerability Actively Exploited in Attacks

Critical Microsoft SharePoint Vulnerability Under Active Exploitation

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-56164, a severe vulnerability in Microsoft SharePoint Server, to its Known Exploited Vulnerabilities (KEV) catalog after confirming real-world exploitation. The flaw, classified as a missing-authentication vulnerability (CWE-306), allows unauthenticated attackers to remotely escalate privileges on on-premises SharePoint deployments.

Exploitation of this vulnerability grants attackers elevated access, enabling them to compromise sensitive documents, modify content, create unauthorized accounts, or move laterally within connected systems. While CISA has not linked the flaw to ransomware campaigns, internet-facing SharePoint servers often containing business-critical data and integrations remain prime targets.

CISA added the vulnerability to its KEV catalog on July 14, 2026, with a remediation deadline of July 17, 2026, requiring federal agencies to patch or mitigate the issue within three days. Organizations are urged to prioritize externally accessible SharePoint instances, apply Microsoft’s security updates, and follow Binding Operational Directive (BOD) 26-04 for risk-based patching.

If patches are unavailable, CISA recommends discontinuing use of affected products or implementing compensating controls, such as restricting public access, enforcing network segmentation, and isolating compromised systems. Security teams should conduct threat hunting and forensic analysis, monitoring for unusual authentication activity, unauthorized privilege changes, web shells, and abnormal document access.

Given the potential for privilege escalation and broader network compromise, defenders are advised to assume that a breached SharePoint server could provide attackers with access to additional enterprise resources.

Source: https://cybersecuritynews.com/sharepoint-server-vulnerability-exploited/

Microsoft TPRM report: https://www.rankiteo.com/company/microsoft_sharepoint

"id": "mic1784118231",
"linkid": "microsoft_sharepoint",
"type": "Vulnerability",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'type': 'Organization'}],
 'attack_vector': 'Remote Exploitation',
 'data_breach': {'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Sensitive documents, '
                                             'business-critical data'},
 'date_publicly_disclosed': '2026-07-14',
 'description': 'CISA has added CVE-2026-56164, a severe vulnerability in '
                'Microsoft SharePoint Server, to its Known Exploited '
                'Vulnerabilities (KEV) catalog after confirming real-world '
                'exploitation. The flaw allows unauthenticated attackers to '
                'remotely escalate privileges on on-premises SharePoint '
                'deployments, enabling compromise of sensitive documents, '
                'modification of content, creation of unauthorized accounts, '
                'or lateral movement within connected systems.',
 'impact': {'data_compromised': 'Sensitive documents, business-critical data',
            'operational_impact': 'Unauthorized account creation, content '
                                  'modification, lateral movement',
            'systems_affected': 'Microsoft SharePoint Server (on-premises '
                                'deployments)'},
 'post_incident_analysis': {'corrective_actions': 'Patch management, network '
                                                  'segmentation, enhanced '
                                                  'monitoring',
                            'root_causes': 'Missing-authentication '
                                           'vulnerability (CWE-306) in '
                                           'Microsoft SharePoint Server'},
 'recommendations': 'Prioritize externally accessible SharePoint instances, '
                    'apply security updates, implement compensating controls, '
                    'conduct threat hunting and forensic analysis.',
 'references': [{'date_accessed': '2026-07-14',
                 'source': 'CISA Known Exploited Vulnerabilities (KEV) '
                           'catalog'}],
 'regulatory_compliance': {'regulatory_notifications': 'Binding Operational '
                                                       'Directive (BOD) 26-04'},
 'response': {'containment_measures': 'Restrict public access, enforce network '
                                      'segmentation, isolate compromised '
                                      'systems',
              'enhanced_monitoring': 'Threat hunting, forensic analysis, '
                                     'monitoring for unusual authentication '
                                     'activity, unauthorized privilege '
                                     'changes, web shells, and abnormal '
                                     'document access',
              'network_segmentation': 'Enforced',
              'remediation_measures': 'Apply Microsoft’s security updates, '
                                      'discontinue use of affected products if '
                                      'patches are unavailable'},
 'title': 'Critical Microsoft SharePoint Vulnerability Under Active '
          'Exploitation (CVE-2026-56164)',
 'type': 'Privilege Escalation',
 'vulnerability_exploited': 'CVE-2026-56164 (Missing-Authentication '
                            'Vulnerability, CWE-306)'}