CVE-2026-56164KEV · OVERDUECWE-306

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Medium · published July 14, 2026

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 5.3. It is confirmed in active exploitation. It sits in the 62.8th percentile for exploit probability.

99
days past CISA
deadline
CVSS v3.1
5.3
EPSS
1%
Percentile
62.8
In the wild
Confirmed
What it is

Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.01011 · 62.8th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-07-14T17:05Z
KEV added
2026-07-14 · due 2026-07-17
EPSS history
Timeline
  • 25 SEP 03:26Z
    EPSS moved 27% → 1%
    epss
  • 14 JUL 17:05Z
    Microsoft SharePoint Server Elevation of Privilege Vulnerability
    cvelistv5
  • 14 JUL 00:00Z
    Added to CISA KEV — remediate by Jul 17
    kev