On-premises Microsoft SharePoint Server is affected by CVE-2026-56164, which lets an unauthenticated network attacker elevate privileges, and CVE-2026-58644, an untrusted-deserialization issue that permits code execution. Their impacts and fixed builds differ. Track and verify remediation for each CVE instead of treating them as one vulnerability.
Immediate Actions to Take
- ✓Install at least the fixed build for CVE-2026-56164
- ✓Install at least the fixed build for CVE-2026-58644
- ✓Identify internet-facing servers and restrict unnecessary management reachability until updating is complete
- ✓Review IIS and SharePoint logs, added files, configuration changes, and account changes for compromise
Vulnerability Overview and Scope of Impact
CVE-2026-56164 is an authentication bypass vulnerability (CWE-306) affecting on-premises versions of Microsoft SharePoint Server (SharePoint Server 2016, 2019, and Subscription Edition). Attackers can remotely escalate privileges over the network without requiring authentication or user interaction.
Microsoft rates CVE-2026-56164 CVSS v3.1 5.3 MEDIUM. Fixed build floors are 16.0.5561.1001 for SharePoint 2016, 16.0.10417.20175 for 2019, and 16.0.19725.20434 for Subscription Edition. If another assessor's higher score is discussed, name that assessor and vector rather than hiding Microsoft's rating.
CVE-2026-58644 is a separate vulnerability rated CVSS v3.1 9.8 CRITICAL by Microsoft. It permits unauthenticated code execution over the network through deserialization of untrusted data. Fixed build floors are 16.0.5556.1005 for SharePoint 2016, 16.0.10417.20153 for 2019, and 16.0.19725.20384 for Subscription Edition. AD FS CVE-2026-56155 is unrelated to SharePoint and requires separate AD FS handling.
Specific Impacts and Attack Scenarios
CVE-2026-56164 is missing authentication for a critical SharePoint function and enables privilege elevation. CVE-2026-58644 is deserialization RCE. The published Microsoft records for these CVEs do not describe stolen machine keys or deployment of a particular malware family as intrinsic behavior of either flaw.
This could lead to the leakage of confidential information, to systems being taken over, and to service outages or data destruction.
On exploitation, here is only what the sources support. Microsoft rates both CVE-2026-56164 and CVE-2026-58644 as exploited, and the temporal metrics give an Exploit Code Maturity of Functional (E:F in the vector).
Which threat groups are involved, and which sectors they target, cannot be established from this article’s sources, the Microsoft MSRC entries and the CVE records. So it is not claimed here.
Response Procedures and Verification Methods
After updating, verify that every SharePoint build meets both applicable fixed floors. For servers that were exposed before patching, review IIS and SharePoint logs, suspicious files in web and temporary directories, administrator and service accounts, and configuration changes. If compromise is suspected, isolate the server and follow the organization's incident-response process.
📦