Microsoft SharePoint Server Vulnerability CVE-2026-56164: What You Need to Know
A critical vulnerability in Microsoft SharePoint Server (CVE-2026-56164) allows unauthorized attackers to elevate privileges. Patches are available and should be applied immediately.
What happened
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that CVE-2026-56164, a critical deserialization vulnerability in Microsoft SharePoint Server, is being actively exploited in the wild. This vulnerability allows an attacker authenticated as at least a Site Owner to execute arbitrary code remotely on the SharePoint Server. The attack complexity is low, as the attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.
The vulnerability impacts Microsoft SharePoint Server Subscription Edition, Microsoft SharePoint Server 2019, and Microsoft SharePoint Enterprise Server 2016. Microsoft has released patches as part of the Patch Tuesday updates on July 14, 2026. It is crucial for organizations using these versions of SharePoint Server to apply the patches immediately to mitigate the risk of exploitation.
For more detailed information, consult the primary sources: NCSC-2026-0237, CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV, and [CISA KEV] CVE-2026-56164 — Microsoft SharePoint Server.
How 0Day mitigates this
microsoft sharepoint server is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.