Microsoft fixes three critical SharePoint flaws, one already exploited

Microsoft fixed three critical vulnerabilities in on-premises SharePoint Server on July 14, including one that it says attackers were already exploiting. The Canadian Centre for Cyber Security followed with alert AL26-017 on July 15, urging organizations to update.

SharePoint servers have been a repeated target over the past year because they often sit on the internet and hold sensitive documents. The July release landed on the same day SharePoint Server 2016 and 2019 reached end of life, leaving organizations still on those versions with a shrinking window to move.

The three flaws

• CVE-2026-56164 is a missing-authentication bug that lets an unauthenticated attacker elevate privileges over a network. Microsoft said it is aware of exploitation of this flaw and of other previously released SharePoint bugs. CISA added it to its Known Exploited Vulnerabilities catalog on July 14. Microsoft scored it 5.3, while NIST's NVD rated it 9.8.
• CVE-2026-55040 is a weak-authentication flaw rated 9.1 that lets an unauthenticated attacker bypass a security feature. Rapid7, which reported it, published an analysis and proof-of-concept code on Aug. 11 showing how chained weaknesses in SharePoint's token validation let an attacker forge a token and act as a site user or administrator. CISA added it to the KEV catalog on Aug. 18.
• CVE-2026-58644 is a deserialization flaw rated 9.8 that lets an unauthenticated attacker run code over a network. CISA added it to the KEV catalog on July 16.

Fixed versions

The Cyber Centre lists these minimum builds:

• SharePoint Enterprise Server 2016: 16.0.5561.1001
• SharePoint Server 2019: 16.0.10417.20175
• SharePoint Server Subscription Edition: 16.0.19725.20434

Note that the Cyber Centre's alert spells the first identifier as CVE-2026-55164 in one place. The correct identifier, per Microsoft and NVD, is CVE-2026-56164.

What to do

• Install the July 2026 SharePoint updates and confirm the build numbers above.
• Plan migration off SharePoint 2016 and 2019, which no longer receive regular support.
• Enable AMSI integration in Full Mode, restrict internet exposure and limit access to Central Administration.
• Look for web shells, unexpected privilege changes and signs of IIS machine key theft, and rotate machine keys if compromise is suspected.