Microsoft SharePoint CVE-2026-56164

No special authentication or user interaction is required - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against on-premises Microsoft SharePoint Server, where a critical function is exposed without any authentication check (CWE-306). The concrete prerequisite is network reachability to the affected SharePoint web front-end (the vulnerable endpoint must be accessible to the attacker, e.g. internet-facing or reachable on an internal network). Limiting factors: only the on-premises editions listed in the CPEs are affected (Enterprise Server 2016, Server 2019, Subscription Edition) - SharePoint Online is not listed; unpatched builds are required; and exposure depends on whether the affected endpoint is reachable from the attacker's network position, so farms fully isolated from untrusted networks face reduced practical risk.

This is a genuine top-priority issue rather than a high-CVSS-but-low-risk theoretical flaw: every available signal aligns. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction and high impact across C/I/A. That is corroborated by CISA KEV listing (confirmed active exploitation in the wild) and by the existence of publicly available exploit code - two independent signals that lower the barrier for both targeted and opportunistic attacks. An EPSS score was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here; however, KEV status makes EPSS largely moot for prioritization. SSVC-style reasoning also points to the highest tier: exploitation status = active, automatable = likely yes (unauthenticated network vector with public POC), technical impact = total. No signals conflict. The only caveat is that the description labels this 'elevate privileges' while the vector is PR:N - the practical reading is that an unauthenticated actor gains elevated (privileged) capability against the farm; verify exact post-exploitation privilege scope against Microsoft's advisory.

An attacker who can reach an on-prem SharePoint web front-end over the network sends a crafted request directly to the unauthenticated critical function, bypassing login entirely and obtaining elevated privileges on the farm. Because publicly available exploit code exists and no user interaction or credentials are required (AV:N/AC:L/PR:N/UI:N), this can be executed opportunistically at scale against exposed servers and is already being used in the wild per CISA KEV. From that foothold the attacker can pivot toward data theft, content tampering, or full farm takeover.