CVE-2026-56164
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Vexday Risk Score
63High priority
SSVC decision (CISA)
Act
Exploitation + impact → act immediately
Exploit maturity
Proof of concept
Public proof of concept exists, but not yet automated.
CVSS 5.3EPSS 7.0%KEV simPoC públicaNuclei —Metasploit —Patch referenciado
Lifecycle
14 Jul 2026Active exploitation (CISA KEV)
14 Jul 2026Published on NVD
15 Jul 2026Public PoC
Weaponization speed
1 daysto first PoC
Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.
Recommendation: Patch as soon as possible — active exploitation confirmed.
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C
Affected products
Microsoft · Microsoft SharePoint Enterprise Server 2016Microsoft · Microsoft SharePoint Server 2019Microsoft · Microsoft SharePoint Server Subscription Editionpublic PoCs found — 1
githubgithub.com/sentinel-aidefense/CVE-2026-56164-EXP★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.