CVE-2026-56164: SharePoint Zero-Click Privilege Escalation

If you rely solely on CVSS scores to prioritize your enterprise patch cycle, CVE-2026-56164 will eventually catch you off guard. Microsoft stamped this SharePoint Server vulnerability with a deceptively mild 5.3 base score during their July 2026 release cycle. Yet, within hours of its disclosure, the Cybersecurity and Infrastructure Security Agency (CISA) added it to the Known Exploited Vulnerabilities (KEV) catalog, confirming active, in-the-wild exploitation by advanced threat actors.

A 5.3 rating usually implies significant caveats—perhaps the attacker requires prior authentication, localized network access, or complex user interaction. That is simply not the case here. This is a network-based, unauthenticated, zero-click privilege escalation flaw. Attackers are currently chaining it with secondary techniques to seize complete administrative control over on-premises SharePoint farms.

This post dissects exactly what happened, how the underlying exploit chain bypasses your perimeter controls, and why your Active Directory exploitation threat models just became a bit more complicated. We will look past the sanitized vendor advisories to understand the mechanics of the attack, focusing heavily on how threat actors translate a missing authentication check into persistent remote code execution (RCE).

Why a "Moderate" Flaw is Actually Critical

The jarring discrepancy between the assigned CVSS score and the real-world threat stems from how severity metrics are fundamentally calculated. Evaluators scored the isolated, theoretical impact of the privilege escalation vulnerability on its own. They did not score the entire exploit chain that attackers deploy in practice. But attackers do not exploit bugs in a vacuum.

By abusing CVE-2026-56164 (NVD), an unauthenticated adversary can bypass critical access controls on exposed SharePoint Server endpoints. Once they elevate their privileges to a farm administrator level, they immediately pivot to their actual goal.

Their primary target? The underlying IIS machine keys.

A high-level network flow showing how an unauthenticated attacker bypasses access controls to extract IIS machine keys and escalate to RCE.

If an attacker successfully extracts the IIS machine keys, they hold the cryptographic secrets required to forge ViewState payloads and authentication tokens. This leads directly to remote code execution via insecure deserialization. We saw identical post-exploitation tactics during the recent incidents, where attackers turned localized configuration bugs into enterprise-wide persistence. A 5.3 bug that reliably chains into complete domain compromise is a critical threat, regardless of what the metric suggests.