CISA Flags Exploited SharePoint Server Flaw: What Businesses Should Patch Now

What CISA and Microsoft Confirmed

Microsoft describes the flaw as missing authentication for a critical function in SharePoint, allowing an unauthorized network attacker to elevate privileges. The Microsoft record lists a network attack vector, low attack complexity, no required privileges, and no user interaction. It assigns a CVSS 3.1 base score of 5.3 and labels severity Moderate.

CISA’s machine-readable record gives covered federal agencies a July 17, 2026 due date under its applicable directive. That date is not a universal private-sector legal deadline. For a business, nonprofit, school, healthcare organization, law firm, managed-service provider, or local government, the practical question is whether an affected server exists, whether it is reachable from untrusted networks, and how quickly the exact update path can be completed and verified.

Source-coded patch map

Affected SharePoint Editions, Updates, and Fixed Builds

The three cards below reconcile Microsoft’s CVRF product IDs, July update index, KB pages, and SharePoint packaging guidance. The fixed build is the build Microsoft lists for the security update, not a claim that every farm will display it identically before configuration completes.

TPTK action framework

Six-Step SharePoint Response Sequence

This sequence separates business ownership from farm administration. It is a decision framework built from Microsoft’s update prerequisites, packaging guidance, AMSI documentation, and CISA’s exposure emphasis; it does not replace the change plan for a specific farm.

1. 1
   Inventory the environment

   Record every SharePoint Server farm, edition, build, server role, language pack, Workflow Manager dependency, custom solution, owner, hosting provider, and external access path. Confirm whether a vendor-managed or disaster-recovery farm is also affected.

2. 2
   Reduce exposure while the change is prepared

   Prioritize internet-facing and externally accessible farms. Use existing network controls to limit untrusted access where operationally feasible. Confirm AMSI is active; for Subscription Edition, Microsoft specifically supports request-body scanning and its CVE guidance points to Full mode as a mitigation. AMSI is an extra layer, not a patch substitute.

3. 3
   Prepare a recoverable change

   Back up the farm and databases according to the organization’s tested recovery plan, document custom components, validate available space and maintenance timing, and obtain the exact core/language or combined package set. Check Workflow Manager prerequisites before installing the farm update.

4. 4
   Patch every server in the farm

   Use Microsoft’s supported SharePoint update process for the selected edition. For 2016 and 2019, account for both core and language-pack packages; for Subscription Edition, use the single combined package. Keep farm servers at a consistent patch level.

5. 5
   Run configuration and verify

   Complete the SharePoint Products Configuration Wizard or supported PowerShell equivalent, then verify farm build, service health, search, workflows, authentication, custom solutions, and critical sites. Subscription Edition administrators must also review the post-PSConfig actor-token command in KB5002882.

6. 6
   Check for signs of compromise and escalate

   Known exploitation means patch success is not proof that the server was never targeted. Review the organization’s SharePoint, IIS, identity, endpoint, network, and security telemetry under the incident-response plan. Escalate suspicious findings to the security team, managed provider, insurer, legal/compliance owner, or incident-response partner as appropriate.

Why a 5.3 Base Score Still Deserves Urgent Attention

Fact versus recommendation: The score, vector, and exploitation status are Microsoft/CISA facts. Giving affected exposed farms emergency priority is TPTK’s editorial recommendation based on those facts.

SharePoint Online Versus SharePoint Server

Organizations with Microsoft 365 should still check architecture records before closing the alert. Hybrid migrations, old departmental servers, test farms, and third-party-hosted environments can survive long after users believe everything moved online.

Related TPTK Security and Continuity Guidance

After the immediate SharePoint actions are owned, strengthen the surrounding controls with a small-business backup software plan, a managed antivirus and endpoint-protection decision, and mobile-device management for the devices that reach business systems. If SharePoint’s role is mainly internal communication, use TPTK’s employee communication software guide for the durable platform decision; do not migrate in the middle of an incident without a controlled plan.

What Remains Unknown

TPTK will update this permanent URL if CISA or Microsoft changes the affected products, exploitation status, mitigation, fixed builds, prerequisites, known issues, or response guidance.

SharePoint CVE-2026-56164 FAQ