CVE-2026-56164

CVE-2026-56164 is a critical SharePoint vulnerability (CVSS 9.8) on CISA's Known Exploited Vulnerabilities catalog — meaning active exploitation is confirmed. But its EPSS score of roughly 22% is notably muted for a KEV-listed flaw. That gap is your first signal to look deeper. The most likely explanation: this isn't a wide-open unauthenticated RCE from the internet. SharePoint's granular permission model means 'elevate privileges' could mean anything from editing a specific document library to gaining host-level system access — and that distinction changes everything for your risk calculation. What you should do now: First, assume urgency regardless of the EPSS number — KEV listings exist because exploitation is observed, not theoretical. Second, determine your SharePoint version and whether it falls within the affected range. Third, and this is the critical question your IR team should be pressing: what specific function loses its authentication check, and does successful exploitation translate to Windows-level privileges on the host server? If the privilege escalation is limited to SharePoint's permission model and your deployment follows least-privilege defaults, your exposure may be narrower than the CVSS suggests. If it leads to host compromise, treat this as critical infrastructure exposure regardless of the EPSS signal. The CISA listing gives you exploitation confidence — your environment assessment gives you the rest.

Reviewed through automated stages and approved by a human before publication.