In short: On August 13, 2026, Positive Technologies highlighted two critical Microsoft SharePoint Server vulnerabilities rated CVSS 9.8 in its monthly digest — both are being actively exploited in the wild. In July, attackers breached Switzerland's Federal IT and Telecommunications Office (BIT), compromising approximately 200 accounts. Patches were released in Microsoft's July Patch Tuesday — apply them immediately.
What Happened
On August 13, 2026, Positive Technologies released its August digest of trending vulnerabilities, spotlighting two critical flaws in Microsoft SharePoint Server: CVE-2026-56164 (privilege escalation) and CVE-2026-58644 (remote code execution). Both scored 9.8 out of 10 on the CVSS 3.1 scale — among the highest possible severity ratings. Microsoft officially confirmed that both CVEs are being actively exploited in real-world attacks. For context on why credential theft is the final goal of such attacks, see our breakdown of how infostealers steal passwords and cookies.
The impact is already documented. On July 28, 2026, Switzerland's Federal Office for IT and Telecommunications (BIT) disclosed a SharePoint server compromise in which attackers extracted credentials from approximately 200 user and technical accounts. BIT did not specify which CVEs were used, but the timing aligns directly with these vulnerabilities appearing in the July Patch Tuesday release.
How the Vulnerabilities Work
CVE-2026-56164 is an unauthenticated privilege escalation flaw. An attacker with no credentials can remotely escalate to Farm Administrator — SharePoint's highest administrative level — simply by sending a crafted request to the server. No password and no user interaction required: the server falls back to an elevated security context instead of rejecting the unauthenticated request. With Farm Administrator access, an attacker can enumerate all site collections, manage users, and execute commands on the server.
CVE-2026-58644 is an unsafe deserialization vulnerability leading to remote code execution. It requires Site Owner privileges to exploit, but this is where the two flaws form a dangerous chain: an attacker uses CVE-2026-56164 to gain elevated rights, then triggers CVE-2026-58644 to execute arbitrary code. The combined attack enables full server takeover — document theft, credential extraction, and lateral movement across the corporate network. All current on-premises SharePoint versions are affected: Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016.
What This Means for Your Data
SharePoint is one of the most widely deployed enterprise platforms for document storage and collaboration. If your organization runs it on-premises, the threat is direct: an attacker with no credentials could potentially access every document in the system and harvest credentials from all users.
For ordinary employees, the risk is not abstract: compromised accounts are used to launch phishing campaigns from trusted colleagues' addresses, distribute malicious files within the organization, and pivot to adjacent systems like email, CRM, and ERP. The Swiss BIT incident showed that even well-resourced government IT operations may not patch quickly enough to stay ahead of active exploitation. A corporate VPN for remote work adds an important layer of defense: a VPN tunnel keeps SharePoint invisible to external attackers, significantly shrinking the attack surface during the window before a patch is deployed.
How to Protect Yourself
Priority steps for anyone administering corporate infrastructure or using SharePoint on-premises:
- Apply patches immediately. Microsoft released fixes for CVE-2026-56164 and CVE-2026-58644 in the July 2026 Patch Tuesday. Verify that all SharePoint Server 2016, 2019, and Subscription Edition instances in your organization are fully updated.
- Enable AMSI on all SharePoint web applications. Microsoft specifically recommends activating Antimalware Scan Interface and setting the request body scan mode to Full — this reduces the risk of successful exploitation even before patching is complete.
- Review logs for signs of compromise. Look for unusual privilege escalation requests, newly created administrator accounts, and unexpected outbound network connections from your SharePoint server.
- Isolate SharePoint behind a VPN tunnel. If remote employees connect to corporate resources, a no-logs VPN makes your SharePoint server invisible to external attackers — without tunnel access they cannot reach the vulnerable endpoint to send an exploit. This is not a substitute for patching, but significantly reduces the attack surface.
- Apply least-privilege access. Audit who holds Site Owner permissions in SharePoint — excessive rights combined with CVE-2026-58644 create a direct entry point for an attacker who has already gained a foothold via CVE-2026-56164.