CVE-2026-56164

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jul 14, 2026

Description

Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Jul 14, 2026
Last modified
Jul 14, 2026
Added to CISA KEV
Jul 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-561659.8Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.CVE-2026-561678.8Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network.CVE-2026-561686.5Null pointer dereference in Windows SMB Server allows an authorized attacker to deny service over a network.CVE-2026-561698.8Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.CVE-2026-56178.8The Login as User plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to theCVE-2026-561707.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-561717.5Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information oveCVE-2026-561727.8Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.CVE-2026-561737.0Use after free in Windows WebView allows an authorized attacker to elevate privileges locally.CVE-2026-561747.8Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.CVE-2026-561757.8Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-561767.8Out-of-bounds read in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVE-2026-56164: Critical severity, CVSS 9.8 | Vulnix