Loading vulnerability…
CVE-2026-56164 is an elevation-of-privilege vulnerability in Microsoft Office SharePoint / Microsoft SharePoint Server caused by missing authentication for a critical function. The flaw allows an unauthenticated attacker to reach a privileged server-side function over the network without first establishing valid authentication. Available reporting indicates exploitation can be performed through crafted HTTP POST requests against exposed on-premises SharePoint deployments. Microsoft described the issue as requiring no existing privileges and low attack complexity. Affected product lines include SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition prior to the July 2026 security updates.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
Repository contains a documented proof-of-concept and detection notes for SharePoint /_trust WS-Federation SecurityContextToken deserialization leading to unauthenticated RCE and machine-key theft. Structure is small and focused: README and index.html provide the writeup; detection/hunting.md contains defender-oriented hunting guidance; artifacts/ contains redacted example telemetry; scripts/ contains the actual exploit code. The main exploit capability is in scripts/cve-2026-58644_oob_param.ps1. It is a parameterized PowerShell exploit that builds a PowerShell payload, base64-encodes it for -EncodedCommand, invokes ysoserial.net to generate a BinaryFormatter gadget (default TypeConfuseDelegate), wraps the raw gadget bytes with System.IdentityModel.DeflateCookieTransform, embeds that into a crafted WS-Federation RequestSecurityTokenResponse, and POSTs it to $Target/_trust/default.aspx with wa=wsignin1.0. Capabilities include arbitrary command execution, optional HTTP callback/beaconing, optional file drop, optional diagnostic exfiltration, proxy support, and optional direct powershell execution via --rawcmd to avoid cmd.exe in the process tree. The second exploit, scripts/cve-2026-58664_machinekeys.ps1, is a two-stage PowerShell exploit for in-process machine-key disclosure. It generates two ysoserial payloads: a preamble using ActivitySurrogateDisableTypeCheck and a main payload using ActivitySurrogateSelectorFromFile to compile embedded C# code (KeyDump) inside w3wp.exe. That C# reflects into System.Web.Configuration.MachineKeySection, extracts ValidationKey/DecryptionKey and related settings, clears the HTTP response, and writes the values back between sentinel markers. This is more stealthy than the OOB RCE path because it avoids child process creation and external beaconing. Overall, this is a real exploit repository rather than a detector-only repo. It is not part of a major exploitation framework. The code is operational but still PoC-style: payloads are customizable through parameters, but execution depends on an external ysoserial.net binary and a vulnerable SharePoint deployment. The most fingerprintable target artifact across both scripts is POST traffic to /_trust/default.aspx carrying wa=wsignin1.0 and a RequestSecurityTokenResponse/SecurityContextToken body.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
170 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Another SharePoint vulnerability mentioned only as background comparison in a list of previously confirmed exploited flaws.
A previously mentioned SharePoint vulnerability cited only as background comparison in a list of other exploited SharePoint flaws this summer.
An actively exploited Microsoft SharePoint privilege escalation vulnerability linked in the article to the Swiss federal IT department breach.
A Microsoft SharePoint Server vulnerability listed among vulnerabilities actively exploited or operationally weaponized in July 2026.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.