CVE-2026-56164 · Microsoft SharePoint Server

Missing authentication for a critical function can allow an unauthenticated attacker to modify SharePoint data over the network.

What changed

Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019 and SharePoint Server Subscription Edition. SharePoint 2016: 16.0.5561.1001 · SharePoint 2019: 16.0.10417.20175 · Subscription Edition: 16.0.19725.20434

Technical details

KB5002891 · KB5002883 · KB5002882; enable SharePoint AMSI integration with Full request-body scanning as additional mitigation.

Why it matters

MSRC Exploitation Detected · confirmed by CISA KEV

Known limitations

MSRC Exploitation Detected · confirmed by CISA KEV

Now check

Install the applicable SharePoint security update immediately, enable AMSI integration for SharePoint and IIS worker processes, and review internet-facing farms for compromise indicators.