CVE-2026-56164: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability
Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.
Overview
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
Vulnerability details
CVE-2026-56164 is a missing authentication for critical function flaw (CWE-306) in Microsoft SharePoint Server. A critical SharePoint function or endpoint is reachable over the network without any authentication check, meaning the server accepts and processes requests to that function regardless of whether the caller has established a valid session or identity. This class of weakness arises when developers omit authentication enforcement on a code path that was assumed to be internal or protected by upstream controls, but is in practice directly reachable by any network peer.
An attacker sends a crafted network request directly to the unauthenticated SharePoint endpoint, requiring no credentials and no user interaction. The precondition is that the target SharePoint instance is network-reachable and running an unpatched version. Successful exploitation yields privilege elevation within SharePoint. Microsoft's own assessment indicates limited integrity impact, meaning constrained data modification rather than full system compromise. The NVD and CISA KEV assessments assign higher impact across confidentiality, integrity, and availability, and the exact privilege level attained is not settled by available facts. Functional exploit code is reported to exist.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review SharePoint Unified Logging Service (ULS) logs and IIS access logs for requests to SharePoint endpoints that complete successfully (HTTP 200) with no associated authentication token, session cookie, or claims identity, particularly from external or unexpected source addresses.
- Monitor Windows Security event logs on SharePoint servers for privilege-related events (such as token creation or permission grants) that occur without a preceding successful authentication event for the same source session, which may indicate exploitation of the unauthenticated function.
- Audit SharePoint server patch levels against the fixed boundaries: SharePoint Enterprise Server 2016 build 16.0.5561.1001, SharePoint Server 2019 build 16.0.10417.20175, and Subscription Edition build 16.0.19725.20434. Any instance below these thresholds and reachable from untrusted networks is unambiguously at risk.
Remediation
Additional hardening
- Upgrade SharePoint Enterprise Server 2016 to build 16.0.5561.1001 or later, SharePoint Server 2019 to build 16.0.10417.20175 or later, and SharePoint Server Subscription Edition to build 16.0.19725.20434 or later. See References for the vendor advisory.
- Restrict network access to SharePoint Server instances using perimeter controls or host-based firewall rules so that only authorized internal networks and authenticated VPN clients can reach SharePoint HTTP/HTTPS ports, reducing exposure to unauthenticated inbound requests.
- Place SharePoint behind a reverse proxy or web application firewall configured to require authentication before forwarding requests to the SharePoint farm, providing a compensating control that can block unauthenticated calls to internal endpoints even on unpatched instances.
- Conduct forensic triage per CISA BOD 26-04 guidance (see References) on any internet-exposed SharePoint instance, reviewing IIS and ULS logs for anomalous unauthenticated successful requests prior to patch application to determine whether exploitation has already occurred.
Key dates
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56164
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-56164
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56164
Frequently asked questions
Does CVE-2026-56164 affect my FedRAMP authorization?
If Microsoft SharePoint Server runs inside your authorization boundary, CVE-2026-56164 affects your FedRAMP authorization directly. CISA has listed this vulnerability in its Known Exploited Vulnerabilities catalog, with a remediation deadline of July 17, 2026. An unpatched Known Exploited Vulnerability inside your boundary is an assessor finding. You must either remediate it before that date or formally document a mitigation, before your assessor or sponsoring agency raises it on your behalf.
How does Knox help me handle CVE-2026-56164?
Knox does not patch Microsoft SharePoint Server for you. Under the FedRAMP shared-responsibility model, that remediation is yours to own. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage to document the fix for your next assessment. Applying the patch is your responsibility; maintaining a compliant posture while you do it is not something you manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment continuously for newly disclosed vulnerabilities and compliance issues, including CVE-2026-56164. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you the lead time to act before a finding becomes a formal problem.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2026-56164 isn't remediated by July 17, 2026?
If CVE-2026-56164 is not remediated by July 17, 2026, it becomes a Plan of Action and Milestones (POA&M) item. A growing POA&M list is precisely what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Meeting the deadline keeps your authorization clean and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
