The 14 July 2026 end-of-support deadline for SharePoint Server 2016 and 2019 landed in the same week that four separate SharePoint vulnerabilities were confirmed under active exploitation. If you're running SharePoint on-premise, here's what actually happened, why four CVEs at once is a bigger deal than one, and what to check before the end of this week.
What Happened With SharePoint This Week
CISA confirmed that four separate SharePoint vulnerabilities are being actively exploited in the wild, not just one. That matters because CVEs are sometimes discovered and patched quietly, well before attackers pick them up. Having four confirmed under active exploitation at once, in the same year, signals a much more concentrated wave of attacker interest in SharePoint specifically.
These aren't new bugs introduced by a recent update. They sit in subsystems that have been part of SharePoint since 2016, and they affect every version built on that foundation, including the latest Subscription Edition. AI-assisted vulnerability research is a big part of why these older, previously overlooked issues are surfacing now: it's simply become faster to fuzz code and find these combinations of bugs.
Breaking Down the Two Critical CVEs
CVE-2025-56164: Missing Authentication
This was the earlier of the two critical vulnerabilities to surface. It's a missing authentication issue for a critical function, but exploiting it still requires some low-level access to the system. That makes it serious, but it's not the most dangerous of the four.
CVE-2025-58644: Unauthenticated Remote Code Execution
This is the one to worry about. It requires no prior access and no authentication at all. If an attacker knows your SharePoint site exists, they can send crafted requests over the network and remotely execute code. It carries a 9.8 severity rating, close to the maximum possible score, which reflects just how little an attacker needs to exploit it.
Why Stolen IIS Machine Keys Are the Real Danger
Beyond the initial breach, attackers behind these exploits have been stealing IIS machine keys and using them to deploy malware that persists inside the same service that serves your SharePoint environment to your users. In practice, that means malicious code can live in a trusted location and be pushed out to your users directly, potentially harvesting credentials that grant access to completely separate systems beyond SharePoint itself.
Who Is Actually Affected
SharePoint Online is not affected by these vulnerabilities. Microsoft has already patched the online service. This issue is specific to SharePoint on-premise deployments, including SharePoint 2016, 2019, and Subscription Edition. If you're running a version older than 2013, you're already dealing with a separate set of unpatched, unsupported risks.
How to Check Your Exposure
Log in to your SharePoint service and confirm which version and build you're currently running. Then check your Windows Update history for the relevant security KB:
● SharePoint Subscription Edition: KB5002873
● SharePoint 2019: KB5002874
● SharePoint 2016: KB5002880
Microsoft's Security Update Guide also lets you search by CVE number to see exactly which patch resolves which vulnerability for your version.
What to Do This Week
Microsoft released security updates for SharePoint 2016 and 2019 on 14 July 2026 that address these vulnerabilities, even though both versions are officially out of support. Patch immediately using the KB references above. Once patched, start planning your upgrade path, since these platforms won't receive fixes indefinitely.
Beyond patching, review whether your SharePoint environment needs to be publicly accessible at all. If it doesn't need to be reachable from anywhere on the internet, put it behind a VPN. Reducing unnecessary exposure shrinks your attack surface regardless of how quickly you can patch.
Frequently Asked Questions
