Skip to main content
Change Risk Intel
CVE tracker

CVE-2026-56164 — Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability

Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.

CVSS
9.8 (Critical)
KEV status
CISA KEV — Listed
First seen (CISA KEV)
Recommended change window
Emergency patch — deploy within 72 hours; SharePoint sits in front of authenticated intranet content and unauth EoP is a bypass primitive.
Vendor advisory
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56164
Affected products
Microsoft SharePoint Server

Why this one matters to a CAB

This is the second SharePoint CVE in the July 2026 KEV cluster and the missing-authentication class is meaningfully different from the deserialization one (CVE-2026-58644). Where the deserialization bug needs a crafted payload, this one is a “call this endpoint and skip auth” primitive — the easiest possible remote signal to weaponize at scale.

Defender’s angle

  • Reverse proxy caveat: some F5 / Netscaler / IIS ARR configurations pre-authenticate SharePoint requests. Confirm your reverse proxy is not silently attaching a service account identity that upgrades an anonymous request into an authorized one.
  • Detection query for Microsoft Sentinel: SecurityEvent | where EventID == 4624 and TargetUserName == "SPFarm" and IpAddress !in (KnownFarmIPs) — anything unexpected in the results between patch disclosure and patch deployment is an incident.
  • If patching slips: block anonymous access at the layer-7 proxy for the affected endpoints named in the MSRC advisory. Blocking the whole site is a business impact CAB should decide, not the SharePoint admin.

What to bring to CAB

A cluster change record referencing CVE-2026-58644, CVE-2026-56164, and CVE-2026-45659 as a single SharePoint July 2026 update wave, with one downtime, one rollback plan, one communication.

Sources

This page summarizes publicly available information from CISA KEV, NVD, and the listed vendor advisory. Change Risk Intel does not publish exploit walkthroughs. Verify with your vendor before scheduling any change window.