Active SharePoint exploitation around CVE-2026-56164 drives patching and federal response

**CVE-2026-56164** is an **actively exploited** **SharePoint Server** vulnerability that lets an unauthenticated attacker **escalate privileges over the network**. The flaw puts **on-premises SharePoint Server** deployments at immediate risk, especially where the service is exposed to remote access. Microsoft has already identified it as a fix-first issue for July 2026.

Attackers are actively exploiting **three SharePoint Server vulnerabilities** against **Internet-exposed on-premises instances**, creating widespread risk of **authentication bypass**, **remote code execution**, and **malware deployment**. The wave affects **all supported self-hosted SharePoint Server versions** and spans nearly **10,000 exposed servers**, including more than **800 unpatched** against two of the CVEs.

**CISA** gave federal agencies until **July 17** to secure or discontinue **SharePoint servers** affected by **CVE-2026-56164**, turning the remediation deadline into a mandatory federal action for exposed systems. The agency had already added **CVE-2026-32201**, **CVE-2026-45659**, and **CVE-2026-56164** to the **Known Exploited Vulnerabilities Catalog** on **April 14**, **July 1**, and **July 14**. Agencies that cannot apply mitigations must **discontinue** the affected servers under **BOD 26-04**.

Microsoft released a **record 622-CVE Patch Tuesday** that includes **two exploited flaws** in **SharePoint Server** and **Active Directory Federation Services**, raising urgency for identity and collaboration systems. The top-priority fixes are **CVE-2026-56164** and **CVE-2026-56155**, both elevation-of-privilege bugs already being used in attacks. Microsoft also bundled additional updates across **Windows**, **Office**, **Edge**, **Azure**, **Defender**, and developer tools. The release matters because defenders must triage a much larger-than-usual update set while attackers can immediately focus on the flaws already in use.