CVE-2026-56164: SharePoint Server Authentication Bypass (CVSS 9.8) Chained in ToolShell-Style Nation-State Attacks

On July 14, 2026, Microsoft released patches for 622 vulnerabilities in the single largest Patch Tuesday in the company's history. Among them was CVE-2026-56164 — a missing-authentication flaw in on-premises Microsoft SharePoint Server that allows an unauthenticated network attacker to escalate privileges without a single credential or user click. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog the same day patches shipped and gave federal civilian agencies just three days — a deadline of July 17 — to apply the fix. That three-day federal mandate signals something specific: CISA had evidence of active exploitation before the patch was public.

If you are running SharePoint Server 2016, 2019, or the Subscription Edition on-premises, this is not a vulnerability to queue for next month's patching cycle. It is one you should have addressed last week.

What CVE-2026-56164 Actually Does

The root cause of CVE-2026-56164 is classified as CWE-306: Missing Authentication for Critical Function. In practical terms, SharePoint Server exposes a specific function over the network — accessible without credentials — that should require authentication before it executes. An attacker who reaches that function can escalate their privilege level to a state that gives them administrative-level access to the SharePoint environment.

Microsoft assigned the vulnerability a CVSS score of 5.3 and rated it "Moderate." That rating has drawn sharp criticism from nearly every independent security researcher and vendor who analysed the bug, because the actual attack characteristics do not match a moderate severity: no credentials required, no user interaction required, remotely exploitable over a network, and already under active exploitation when the patch shipped. The National Vulnerability Database independently scored the same vulnerability at 9.8 — Critical — which is the assessment that reflects operational risk.

The discovery credit on CVE-2026-56164 goes to incident responders from Mandiant and Google's FLARE team. When incident responders find a bug — rather than external researchers — it means the flaw was encountered during a live intrusion investigation. This is not a theoretical risk. Someone was using it before July 14.

The ToolShell Connection

CVE-2026-56164 is not being exploited as a standalone flaw. Threat intelligence reporting from CrowdStrike, Tenable, and Orca Security all describe attackers chaining this vulnerability with previously disclosed SharePoint weaknesses to steal Internet Information Services (IIS) machine keys, establish persistent server access, and deploy second-stage malware.

This attack pattern is directly analogous to the ToolShell campaign of July 2025, in which Chinese nation-state actors — Linen Typhoon, Violet Typhoon, and ransomware operator Storm-2603 — exploited SharePoint Server at scale across the finance, healthcare, government, and energy sectors. The ToolShell campaign used a similar sequence: exploit an authentication weakness to gain initial access, extract IIS machine keys, use those keys to forge ViewState tokens (bypassing .NET deserialization protections), and then deploy web shells for persistent access.

The machine key theft step is what makes SharePoint compromises particularly dangerous. IIS machine keys are used to sign and validate data across a SharePoint farm. An attacker who steals those keys does not need to maintain a web shell — they can generate valid, signed payloads at will, from any network position, without touching the web server again. Rotating IIS machine keys after a compromise is therefore not optional; it is the difference between remediation and an adversary who can return at will.

Affected Versions

CVE-2026-56164 affects on-premises SharePoint Server deployments. The specific affected versions are SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. SharePoint Online (the Microsoft 365 cloud version) is not listed as affected — Microsoft handles patching for the cloud-hosted service and it was updated independently.

If your organisation uses SharePoint Online exclusively, you are not exposed to this specific vulnerability. If you run any on-premises SharePoint environment — including hybrid configurations where on-premises servers federate with SharePoint Online — you are in scope and need to confirm patches are applied.

What Attackers Are Doing in Observed Campaigns

Based on threat intelligence published by CrowdStrike and corroborated by CISA's July 14 advisory, the exploitation chain being observed follows a consistent pattern. Attackers begin with CVE-2026-56164 to gain elevated access to the SharePoint environment without authentication. They then extract IIS machine keys from the compromised server's configuration. Those keys are used to craft malicious ViewState payloads that trigger deserialization — the same technique used in ToolShell 2025 — providing remote code execution under the IIS application pool identity.

From that position, attackers deploy web shells (observed variants include aspx-based shells similar to those used by Linen Typhoon in 2025), establish persistence, and move laterally using the SharePoint server's existing network trust relationships. SharePoint servers frequently have privileged access to SQL Server backends, file shares, and Active Directory — making them pivot-friendly once compromised.

In several observed incidents, this chain is being combined with CVE-2026-45659 (SharePoint deserialization RCE, CVSS 8.8, added to KEV July 1) and CVE-2026-58644 (unauthenticated SharePoint RCE, CVSS 9.8, added to KEV July 16) to maximise persistence options. Organisations that patched one SharePoint flaw but not all three remain partially exposed.

Remediation Steps

The patch for CVE-2026-56164 is included in Microsoft's July 2026 cumulative updates for each affected SharePoint version. Applying those updates is the primary remediation, but patch application alone is insufficient if exploitation has already occurred. The remediation checklist:

Immediate patching. Apply Microsoft's July 2026 cumulative updates to all on-premises SharePoint Server instances. Verify the patches are installed by checking the build number in SharePoint Central Administration — do not rely on Windows Update confirmation alone for a SharePoint farm.

Verify patch completeness. Check that all SharePoint components — including the SharePoint Foundation, SharePoint Server, and the Project Server components if installed — are patched. Partial farm patching leaves exposure.

Rotate IIS machine keys. Whether or not you believe exploitation has occurred, rotate IIS machine keys across your SharePoint farm. The PSCONFIG utility must be run post-patch for some versions; Microsoft's guidance specifies the exact procedure for each affected version. Machine key rotation invalidates any previously forged ViewState payloads and closes the persistence path described above.

Review server and IIS logs for exploitation indicators. Look for unusual HTTP POST requests to SharePoint's /_vti_bin/ and /_layouts/ paths from unauthenticated sources. Look for unexpected .aspx files in SharePoint's web directories. Look for anomalous outbound connections from SharePoint server processes. If you see indicators of compromise, escalate to an incident response engagement before trusting the patched environment.

Audit SharePoint service account permissions. SharePoint service accounts should have the minimum permissions needed to function. Accounts with Domain Admin or local admin rights on non-SharePoint systems create lateral movement paths that attackers exploit after gaining SharePoint access.

Verify all three active SharePoint CVEs are patched. CVE-2026-56164, CVE-2026-45659, and CVE-2026-58644 are all in active exploitation. Treat them as a single remediation task, not three separate tickets.

The Broader Pattern: SharePoint as a Primary Target

CVE-2026-56164 is the third SharePoint Server vulnerability added to CISA's KEV catalog in July 2026 alone. This is not coincidence. SharePoint sits at the intersection of several properties that make it attractive as a persistent attack target: it is internet-facing (or at minimum perimeter-adjacent) in many organisations, it stores sensitive business documents, it has privileged access to databases and Active Directory, and it is frequently underpatch managed because patching a SharePoint farm — which requires coordinated updates across multiple servers and a PSCONFIG run — is operationally inconvenient.

The July 2026 Patch Tuesday's 622-CVE volume is also a signal worth paying attention to. When Microsoft ships 622 patches in a single month, security teams struggle to prioritise. Attackers know this — and they exploit KEV-listed vulnerabilities specifically because they watch for organisations that deprioritise patches during high-volume Patch Tuesday releases.

For organisations running SharePoint Server on-premises: the current threat environment means that SharePoint must be treated as a high-value, high-risk target — with the same patch urgency applied to edge devices and VPN appliances.

How Alastor Can Help

Our team runs dedicated SharePoint security assessments that cover vulnerability enumeration, configuration review, web shell detection, and IIS machine key analysis. If you are uncertain whether your SharePoint environment has been affected by CVE-2026-56164 or any of the related July 2026 SharePoint flaw chain, Alastor Pulse can deliver an initial findings report within six hours and a comprehensive assessment within 48 hours.

To discuss an immediate SharePoint security review, contact us at [email protected].

CVE-2026-56164's real-world CVSS of 9.8 versus Microsoft's official 5.3 illustrates a persistent problem: vendor scoring often underweights exploitation context — if CISA sets a three-day federal deadline and Mandiant found the bug during an active intrusion, organisations should calibrate to the incident responders' assessment, not the vendor's.