SharePoint CVE-2026-56164: Why a 7.8 Elevation of Privilege Reached KEV

On 15 September 2026 CISA urged immediate hardening of Microsoft SharePoint servers in response to a newly disclosed zero-day. The flaw, CVE-2026-56164, is a remotely exploitable elevation of privilege that requires no authentication. It was fixed in Microsoft's July 2026 Patch Tuesday release, and CISA added it to the Known Exploited Vulnerabilities catalog with a three-day remediation window for federal agencies under BOD 26-04.

What is known

CVE-2026-56164 is an elevation of privilege in Microsoft SharePoint Server. It is remotely exploitable and does not require authentication, which places it in the category that matters most for an internet-facing collaboration platform. Microsoft fixed it in July 2026. CISA's KEV addition on 15 September 2026 confirms exploitation in the wild rather than theoretical risk.
The detail that stands out is the gap. A fix existed for roughly two months before the exploitation confirmation and the KEV listing. Any organisation that applied July's updates is not exposed to this specific flaw; any organisation that deferred them has been running an unauthenticated, remotely exploitable elevation of privilege on a service that is frequently reachable from the internet.

Why SharePoint keeps appearing

SharePoint is a recurring target for a structural reason. It is a collaboration platform that is commonly exposed to the internet, it holds documents and business data, and it runs with significant privileges on the host. An elevation of privilege there is not a minor issue, because the process already has access to content and configuration that a normal user does not.
The same month's release also included CVE-2026-69464, an elevation of privilege in SharePoint Server Subscription Edition rated 8.8, described as execution with unnecessary privileges and fixed on 8 September 2026. Two elevation of privilege issues in the same platform within a single cycle is a pattern worth noting when planning exposure reduction.

The recurring lesson about severity

CVE-2026-56164 is not a 9.8. It is a 7.8 elevation of privilege, a class that is often deprioritised behind pre-authentication remote code execution. The KEV listing is the corrective. Exploitation status is a stronger signal than a base score, and for a platform that is internet-facing, holds business data and runs privileged, an elevation of privilege is a serious finding regardless of its number.
This is the same lesson that appeared with the Cisco FMC flaws, where a 5.3 static credential issue was chained with a 10.0 bypass, and with the Windows zero-days in the same month, where two 7.8 elevation of privilege flaws were the exploited items in a release containing dozens of 9.8 remote flaws.

What to do

Confirm whether July 2026 and September 2026 SharePoint updates are applied across every server, including any that sit outside the main patch process. Where a server is reachable from the internet and the update status is uncertain, treat that as the priority.
Reduce the exposure of SharePoint servers that do not need to be directly reachable, and place them behind the appropriate access controls. Review the privileges the SharePoint process holds, so that an elevation of privilege yields less than full control of the host.
Where the update was deferred past the point of exploitation, the patch closes the door but does not establish what happened while it was open. Review authentication and access logs for the period, and check for unexpected changes to site configuration or content.

The takeaway

CVE-2026-56164 is a reminder that the KEV catalog is a better prioritisation input than a severity sort. A 7.8 elevation of privilege on an internet-facing, data-holding, privileged platform was exploited in the wild, and the fix had been available for two months before the exploitation was confirmed.

References

• CISA advisory urging immediate hardening of Microsoft SharePoint servers, 15 September 2026.
• CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-56164.
• Microsoft MSRC advisory for CVE-2026-56164, fixed in the July 2026 security update.
• Microsoft MSRC advisory for CVE-2026-69464, released 8 September 2026.