MySecScan
Scan
News

SharePoint's third active exploit in ten days — why CISA now says patching alone isn't enough

Microsoft's July 2026 Patch Tuesday fixed a SharePoint flaw, CVE-2026-56164, that was already under active attack — the third SharePoint vulnerability exploited in about ten days. CISA is now telling organizations to harden SharePoint servers, not just patch them. If you self-host SharePoint, treat that as the real signal: know what's exposed, don't just wait for the next fix.

By Paul Rudenko, Security ResearcherJul 16, 20267 min read

What happened this time?

On July 14, 2026, Microsoft’s Patch Tuesday shipped fixes for more than 570 vulnerabilities — a record batch — including two already being exploited in the wild: an Active Directory Federation Services bug and CVE-2026-56164, an elevation-of-privilege flaw in on-premises SharePoint Server (Help Net Security).

CVE-2026-56164 was reported by Google’s incident responders and an anonymous researcher, and Microsoft rates it as remotely exploitable in low-complexity attacks. The same update also patched two further SharePoint remote-code-execution bugs (CVE-2026-50522 and CVE-2026-58644) and a critical security-feature-bypass (CVE-2026-55040) in the same product line.

It didn’t stop at the patch. On July 15, Microsoft updated its advisory for CVE-2026-58644 to confirm that exploitation had been detected in the wild too — a day after the fix shipped. And on July 14, CISA published an alert urging organizations running SharePoint to apply additional hardening, because attackers are also still exploiting two previously patched SharePoint bugs — CVE-2026-32201 and CVE-2026-45659, the one we wrote about here on July 6.

Why is patching alone no longer enough?

Here’s the part most of this week’s coverage buries. Rapid7 researcher Stephen Fewer disclosed CVE-2026-55040 as the first half of an exploit chain that, combined with a second bug Microsoft hasn’t patched yet, would allow unauthenticated remote code execution against a SharePoint server. Microsoft is expected to ship the second fix in August 2026 (Rapid7). That means part of this chain is public and part of it isn’t — a live gap, not a closed one.

At the same time, Tenable’s Satnam Narang pointed out something that should change how anyone reads Microsoft’s severity ratings: CVE-2026-45659, the SharePoint bug from July, was originally tagged “exploitation less likely” — and it still ended up on CISA’s Known Exploited Vulnerabilities catalog. We made the same point three weeks ago. This Patch Tuesday is the same lesson playing out a third time, faster.

The reason it’s speeding up isn’t a mystery. Microsoft has said plainly that it’s using AI to find vulnerabilities faster internally — and so are outside researchers and attackers. CISA’s own guidance this month leans the same way: reduce what’s exposed, patch on a shorter clock, and stop assuming a “less likely” label buys you time. When both sides of the fight are moving at machine speed, a monthly patch cadence and a vendor’s guess about exploitability are both weaker signals than they used to be.

For the site owner (plain English)

If your organization uses SharePoint through Microsoft 365 / SharePoint Online, Microsoft runs and patches those servers — this batch of bugs is handled for you.

This is about on-premises SharePoint Server (2016, 2019, or Subscription Edition) — the kind an IT contractor often set up years ago and left running. If that’s you, here’s the order that matters:

  • Apply this month’s SharePoint update, and don’t stop at “we patched it” — a second, still-unpatched piece of the exploit chain is coming in August, so this isn’t a one-time fix.
  • Ask the blunt question again: does this server need to face the internet at all? CISA’s hardening alert exists because a lot of self-hosted SharePoint doesn’t need to be public, and removing that exposure closes more risk than any single patch.
  • If it’s been internet-facing and behind on patches at any point this month, assume it may have been touched and have someone check for signs of compromise (see the FAQ).

None of this is really a SharePoint story. It’s an attack-surface story that happens to be wearing SharePoint’s name this month. You can’t patch, harden, or retire a server you’ve forgotten is exposed. That’s what an external attack-surface scan is for — it looks at your domain from the outside, the way an attacker’s tooling does, and shows you what’s reachable. It won’t tell you “you have CVE-2026-56164” — no honest external scan can — but it will tell you which of your systems are sitting in the open with no good reason to be.

How do developers and IT respond?

  • Patch to the July 2026 security update for your SharePoint edition (Server Subscription Edition, 2019, or Enterprise Server 2016), and confirm the build number post-install.
  • Track the still-open half of the exploit chain. CVE-2026-55040 plus its unpatched companion bug can lead to unauthenticated RCE once both halves are public — expect Microsoft’s August update and prioritize it.
  • Enable AMSI on SharePoint servers, which Microsoft lists as a mitigation for CVE-2026-56164 while you schedule the full patch cycle.
  • Re-check the July 1 advice, too. If CVE-2026-45659 wasn’t fully remediated, attackers are still using it — this isn’t only about the newest CVE.
  • Reduce exposure. Put SharePoint behind a VPN or IP allow-list rather than publishing it openly, and follow CISA’s July 14 hardening guidance in full.
  • References: CISA’s July 14 hardening alert, Microsoft’s advisory for CVE-2026-56164, and Rapid7’s analysis of the exploit chain.

What’s the real lesson here?

We said it three weeks ago and it’s worth repeating because the pattern just repeated itself: the specific CVE is never the point. SharePoint has now had three actively-exploited bugs inside about ten days, on top of one from May that’s still being used against unpatched servers. Ransomware crews and researchers alike are converging on the same target for the same reason — an internet-exposed enterprise app that a lot of organizations set up once and stopped watching.

Patch cadence still matters. But CISA telling people to harden, not just patch, is the tell that patching alone has stopped being sufficient. Knowing your external footprint — and shrinking it — is what actually breaks a pattern like this one.

Frequently asked questions

Is this the same SharePoint bug MySecScan wrote about in July?

No — it's a different, newer bug in the same product, and that's the point. Our July 6 post covered CVE-2026-45659, a SharePoint flaw from May that ransomware crews were exploiting. This post covers CVE-2026-56164 and two related bugs (CVE-2026-50522, CVE-2026-58644) patched on July 14, 2026, which were also found under active attack within a day of the fix shipping. CISA's July 14 alert makes clear both the old and new bugs are being used right now — attackers haven't moved on from the May flaw just because a newer one showed up. If you self-host SharePoint, both matter: confirm the May patch is actually installed, and apply this month's update too. Treating them as one continuous "SharePoint is a live target" situation, rather than a single fixed CVE, is the more accurate way to read what's happening.

Do I need to worry about this if I use Microsoft 365?

No. All three of the actively-exploited SharePoint bugs discussed here affect on-premises SharePoint Server — software an organization installs and runs on its own infrastructure. If your team accesses SharePoint through Microsoft 365 or SharePoint Online, Microsoft owns and patches those servers, so this specific run of vulnerabilities doesn't require anything from you. The simplest test: if you sign in through a microsoft.com or office.com address and have never had to schedule a "SharePoint update," you're on the cloud version and this doesn't apply. If your IT team maintains a SharePoint server with its own domain that your organization hosts and patches itself, that's the on-premises product every one of these CVEs is about, and it's the one to check today.

Do I need to patch separately for every one of these SharePoint CVEs?

Practically, no — Microsoft ships these as part of the same monthly update, so installing July's SharePoint security update addresses CVE-2026-56164, CVE-2026-50522, CVE-2026-58644, and CVE-2026-55040 together. What you do need to track separately is history: if the May 2026 update that fixed CVE-2026-45659 was never fully applied, that's a second, older gap that's still being actively exploited according to CISA's July 14 alert — patching this month's batch doesn't retroactively fix that one. There's also a real forward-looking piece: CVE-2026-55040 is one half of a two-part exploit chain, and the second half is expected to be patched in August 2026. The honest answer is that this isn't a single event to close out — it's an ongoing patch cycle on a product that's been a live target for months, and treating the next update as optional isn't a safe bet right now.

Does MySecScan tell me if I have these specific vulnerabilities?

No, and it's worth being clear about why. MySecScan is an external attack-surface scanner: it looks at your domain from the outside, the way an attacker's tooling does, and reports what's reachable and how it's configured. It does not log into your server or fingerprint software versions to declare "you have CVE-2026-56164," because doing that reliably from the outside isn't possible, and a wrong guess would be worse than no answer. What it does show you is your exposure — which servers, login portals, and admin panels are facing the internet in the first place. In a story like this one, where the same product keeps showing up as a target, that visibility is the part that actually helps: the CVE gets a patch eventually, but only if you know the exposed server exists and someone is watching it.

Sources