CVE-2026-56164: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability

Microsoft SharePoint Server is affected by a missing authentication for critical function vulnerability. An unauthorized attacker can use it to elevate privileges over a network. This matters because the flaw allows network-based privilege escalation in environments where SharePoint handles sensitive content and access controls.

How it works

The weakness is categorized as CWE-306, missing authentication for critical function. In this class of vulnerability, a server component fails to verify that a caller is authorized before performing an action that should require authentication.

An attacker reaches the affected function over the network and issues requests that the server processes without first confirming identity or permissions, resulting in privilege elevation.

Am I affected? How to find it in your systems

Microsoft SharePoint Server typically runs on-premises as part of intranet or collaboration deployments. Inventory all SharePoint Server installations through configuration management databases, server asset lists, and application discovery scans.

• Check every SharePoint Server instance for the presence of the affected component.
• Review configurations that expose SharePoint endpoints to network traffic, especially those reachable from untrusted networks.
• Examine logs for authentication bypass indicators such as unexpected privilege changes or access to administrative functions without prior credential validation.
• Confirm specific affected versions and configurations against the vendor advisory, as public detail is limited.

How to remediate

Apply the vendor update named in the advisory as the primary remediation step. Follow all instructions provided by Microsoft for installing and verifying the fix.

• After patching, re-validate that the critical function now enforces authentication checks.
• Review SharePoint role assignments and remove unnecessary elevated privileges that could be abused if similar issues exist.
• Ensure compliance with CISA BOD 26-04 guidance for prioritizing updates based on risk and asset internet exposure.

If you can't patch immediately

Until the update can be applied, reduce exposure through network segmentation that limits access to SharePoint servers from untrusted sources. Consider web application firewall rules that enforce authentication on the affected function paths where feasible.

• Disable or restrict the specific feature or endpoint if it is not required for business operations.
• Increase monitoring of SharePoint authentication and authorization logs for signs of anomalous privilege use.
• Follow CISA forensics triage requirements and evaluate whether continued use meets applicable BOD 26-04 controls for cloud or on-premises services.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to breaches that expose account data or content stored in SharePoint. Run a free exposure scan of your email addresses against known breach data to check for prior incidents involving your organization.