SharePoint Server CVE-2026-56164 missing authentication, exploited with CVE-2026-32201 and CVE-2026-45659

What happened

On 14 July 2026, Microsoft fixed CVE-2026-56164, a “missing authentication for critical function” flaw in SharePoint Server that lets an unauthenticated attacker elevate privileges over the network. Microsoft rates it CVSS 5.3 (CVE record). Mandiant and Google FLARE incident responders found it during real attacks (Orca Security). Microsoft says it “is aware of exploitation” (Canadian Centre for Cyber Security).

The low score hides the risk because it is used in a chain with two earlier SharePoint bugs (Cynet):

Sources: CVE records for CVE-2026-32201, CVE-2026-45659 and CVE-2026-56164; CISA KEV.

Microsoft first rated CVE-2026-45659 “exploitation less likely.” Attackers chain the bugs to run code, then steal IIS machine keys and use deserialization for persistence and malware. Stolen machine keys let them forge authentication tokens, so access can survive patching until the keys are rotated. Shadowserver tracked close to 10,000 internet-exposed SharePoint servers, several hundred still unpatched (Cynet). CISA flags both CVE-2026-56164 and CVE-2026-45659 for forensic triage under BOD 26-04 (CISA KEV feed).

July also fixed two more unauthenticated SharePoint bugs not known to be exploited as of this update: CVE-2026-55040 (authentication bypass) and CVE-2026-58644 (deserialization, code execution) (Canadian Centre for Cyber Security).

Am I affected?

Any on-premises SharePoint Server 2016, 2019 or Subscription Edition farm below these builds is affected (CVE record):

The July builds are later than the April and May fixed builds for the other two CVEs. Check the farm build in the SharePoint Management Shell:

(Get-SPFarm).BuildVersion

Installing the update through Windows Update is not enough on its own: CISA’s guidance is to validate servicing with the SharePoint Products Configuration Wizard or its PowerShell equivalent on every server, not only the front ends (Cynet).

What to look for, from the Canadian Cyber Centre and Cynet: web shells, malicious processes, unauthenticated IIS requests to sensitive endpoints, signs of IIS machine key access, and Microsoft Defender or AMSI detections for SharePoint exploitation (Canadian Centre for Cyber Security; Cynet). No hashes or IP addresses were published in the sources we opened.

What to do now

1. Patch every server in the farm to the July 2026 builds above, then run the Configuration Wizard (PSConfig) on each. SharePoint 2016 and 2019 reached end of support on 14 July 2026; plan the move to Subscription Edition (Orca Security; Canadian Centre for Cyber Security).
2. Turn on AMSI with Full request body scan. Microsoft recommends this as the interim mitigation for CVE-2026-56164 (Orca Security).
3. Rotate the ASP.NET machine keys, then restart IIS. This is what removes forged-token access. Microsoft’s procedure from the 2025 ToolShell attacks: run Set-SPMachineKey, or in Central Administration go to Monitoring > Review job definitions, find “Machine Key Rotation Job” and select Run Now. Then run iisreset.exe on every SharePoint server (Microsoft).
4. Hunt before you call it fixed. If the farm faced the internet at any point since April 2026, treat it as possibly compromised and look for the artifacts above (Cynet).
5. Cut exposure. Put SharePoint behind a reverse proxy or VPN, block external access to Central Administration, and restrict farm-to-database traffic to the systems that need it (Cynet).
6. Review Site Member permissions. CVE-2026-45659 needs only Site Member rights, so accounts with that role on internet-facing sites are part of the attack surface (Cynet).

Why this matters

A CVSS 5.3 rating would normally sit low in a patch queue. Here it is one link in an exploited chain to code execution, and the fix does not evict an attacker who already has your machine keys. Patch, then rotate keys, then hunt, in that order.

Sources

• Microsoft Security Update Guide: CVE-2026-56164
• Orca Security: Microsoft July 2026 Patch Tuesday, SharePoint zero-day
• Cynet: CISA confirms active exploitation of three on-premises SharePoint CVEs
• Canadian Centre for Cyber Security: AL26-017, critical vulnerabilities in SharePoint Server
• Microsoft: disrupting active exploitation of on-premises SharePoint vulnerabilities (2025, machine key rotation steps)
• CVE records: CVE-2026-56164, CVE-2026-32201, CVE-2026-45659
• CISA Known Exploited Vulnerabilities catalog