CVE-2026-56164: Unauthenticated SharePoint Zero-Day Grants Farm Administrator Access

Microsoft released patches for over 570 vulnerabilities in its July 2026 Patch Tuesday, the largest security update in the company’s history, including two zero-days already under active exploitation. Among them, one stands out for how it is being exploited right now: an unauthenticated vulnerability in SharePoint Server that allows an unauthenticated attacker to elevate privileges to Farm Administrator. 

CVE-2026-56164 is an unauthenticated elevation of privilege vulnerability in SharePoint Server’s client service endpoint that lets an attacker reach Farm Administrator access with no credentials and no user interaction. Microsoft has confirmed exploitation in the wild, and CISA has added it to the Known Exploited Vulnerabilities catalog.  

What Is CVE-2026-56164: The SharePoint Server Missing Authentication Vulnerability 

Risk Analysis 

CVE-2026-56164 is caused by missing authentication for a critical function (CWE-306) inside the Microsoft.Office.Server.UserProfiles assembly, which manages directory operations and user profile properties across SharePoint site collections. The vulnerable pathway is reachable through the client service endpoint at /_vti_bin/client.svc, and it allows an unauthenticated attacker to reach administrative functions inside the User Profile service and escalate to Farm Administrator-level access over the network, with no prior credentials and no user interaction required. 

Affected Versions and Configuration Risks 

The vulnerability affects on-premises SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. SharePoint Online (Microsoft 365) is not affected. 

No special configuration is required for exposure; the client service endpoint is present on a standard installation. Risk concentrates on farms reachable from the internet without a WAF or network segmentation restricting access to the SharePoint client service endpoint, or other exposed administrative endpoints, which is a common state for farms deployed years ago and never re-reviewed against current exposure standards. 

Timing raises the urgency further: Microsoft shipped the fix on July 14, 2026, the same day SharePoint Server 2016 and 2019 reached end of extended support. Organizations still running those versions should treat this as a forcing function to plan migration to a supported release, since future vulnerabilities in those versions will not receive fixes at all. 

Technical Root Cause: Missing Authentication in the User Profile Service Endpoint 

Two things combine to make this exploitable. First, the administrative operations exposed inside the User Profile service through the client object model do not enforce the authentication check they should. Second, the client service endpoint that fronts those operations is reachable by anyone who can send it a request; no credentials are required. 

Public technical analysis indicates that the exploitation involves crafted requests to the SharePoint client service endpoints to invoke privileged functionality within the User Profile service by exploiting insufficient authentication enforcement. Successful exploitation allows an unauthenticated attacker to elevate privileges to Farm Administrator by accessing administrative functionality without proper authorization. 

Why This SharePoint Vulnerability Is Dangerous for Enterprise Content Infrastructure 

On-premises SharePoint rarely sits in isolation. It typically holds an organization’s central document and collaboration store, integrates with Active Directory and Exchange, and connects to line-of-business applications through custom solutions and service accounts. Farm Administrator access sits above nearly all of that. 

Once an attacker holds Farm Administrator rights, they can deploy custom solutions and web parts that execute arbitrary code across every server in the farm. They can also create persistent rogue administrator accounts and read or exfiltrate content from every site collection, regardless of the original permission model. Beyond that, they gain access to credentials for the service accounts SharePoint uses to talk to the rest of the environment, a foothold that extends well beyond SharePoint itself. 

Inside the Attack Chain: From Exposed Client Service Endpoint to Farm Administrator Access

Stage 01, Fingerprint exposed SharePoint instances. Shadowserver currently tracks roughly 10,000 internet-facing SharePoint servers, with more than 800 still unpatched even after public disclosure, a population attackers can scan and fingerprint for a reachable /_vti_bin/client.svc endpoint directly. 

Stage 02, Send a specially crafted request. The attacker sends a specially crafted request to the endpoint targeting privileged functionality within the User Profile service, exploiting insufficient authentication enforcement to invoke administrative operations without prior authentication. 

Stage 03, Escalate to Farm Administrator. Successful exploitation grants the attacker Farm Administrator privileges by allowing unauthorized access to privileged administrative functionality. 

Stage 04, Abuse Farm Admin access for persistence. With Farm Administrator rights in hand, the attacker can deploy malicious solutions or web parts for code execution across the farm, create backdoor admin accounts, and pivot toward the underlying Windows and Active Directory infrastructure through SharePoint’s own service accounts. 

Active Exploitation Timeline 

CVE-2026-56164 was discovered during real-world incident response by Mandiant and Google Cloud’s FLARE team, credited alongside an anonymous researcher. Exploitation was observed in the wild before an official patch existed. 

CISA added CVE-2026-56164 to its Known Exploited Vulnerabilities catalog on July 1, 2026, thirteen days before Microsoft shipped a fix. Microsoft released the patch on July 14, 2026, as part of its July Patch Tuesday update, the same day SharePoint Server 2016 and 2019 reached end of extended support. Federal civilian agencies were given until July 17, 2026, to remediate or disconnect affected instances under Binding Operational Directive 26-04. 

Indicators of Compromise to Monitor 

Organizations running affected SharePoint versions should review for: 

• Unexplained Farm Administrator or site collection admin accounts: check group membership changes against your normal change-management records; any addition without a matching ticket deserves investigation. 

• New or modified custom solutions, features, or web parts: deployments to the farm outside a known release window are a strong signal, since Farm Admin access is what is needed to push them. 

• Unusual requests to /_vti_bin/client.svc , especially unauthenticated or anomalous requests targeting administrative functionality. 

• Requests targeting privileged User Profile service administrative operations from unauthenticated sessions: this endpoint has no legitimate reason to accept unauthenticated administrative calls in a properly configured farm. 

• Unexpected child processes or outbound connections from the IIS worker process (w3wp.exe): since Farm Admin access can lead to code execution, look for unfamiliar processes or network activity around the time of any suspicious request. 

• Service account credential use from unusual hosts: Farm Admin access exposes stored service account credentials that can be reused well beyond the SharePoint farm itself. 

Mitigation Guidance for CVE-2026-56164 

Step 01, Patch immediately. Install the July 2026 security update for SharePoint Enterprise Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition. Given confirmed active exploitation and inclusion in CISA’s KEV catalog, treat this as a priority-one patch regardless of the moderate CVSS score. 

Step 02, Apply Microsoft’s interim mitigations if patching is delayed. Enable Antimalware Scan Interface (AMSI) integration for SharePoint and set the Request Body Scan mode to Full. These reduce exploitation risk but do not replace the security update. 

Step 03, Restrict and monitor access to the client service endpoint. Use network-level controls, reverse proxy rules, or a WAF virtual patch to block unauthenticated or anomalous requests targeting /_vti_bin/client.svc while the official patch is validated and rolled out across the farm. 

Step 04, Assume compromise on any exposed farm. If a farm was internet-facing and unpatched at any point during the exploitation window, don’t treat patching alone as closure. Review Farm Administrator group membership, audit deployed solutions and web parts, rotate service account credentials, and review logs back to at least early July 2026. Treat any unexplained administrative changes or deployed solutions as a potential indicator of compromise requiring investigation. 

How AppTrana Helps Against CVE-2026-56164 Exploitation Attempts 

AppTrana customers get protection against CVE-2026-56164 exploitation attempts from day zero, without waiting on internal patch cycles. AppTrana identifies and blocks malicious requests targeting the vulnerable /_vti_bin/client.svc endpoint. 

Other July 2026 Advisory Vulnerabilities and AppTrana Coverage 

In addition to this zero-day, AppTrana has coverage for other serious vulnerabilities in the July 2026 advisory, including critical vulnerabilities across SharePoint, Exchange, Dynamics, Copilot, Azure OpenAI, Entra, and Azure Synapse, all reachable over HTTP. Here are a few notable vulnerabilities from the advisory which AppTrana covers. 

Stay tuned for more relevant and interesting security articles. Follow Indusface on Facebook, Twitter, and LinkedIn.