GTconsult - Blog #SharePoint 2016 end of supportGTconsult - Blog #SharePoint 2016 end of supporthttps://www.gtconsult.com/blogs/tag/sharepoint-2016-end-of-supportTue, 04 Aug 2026 10:42:43 -0700http://zoho.com/sites/<![CDATA[Four SharePoint Vulnerabilities Are Being Actively Exploited: Here's What to Do]]>https://www.gtconsult.com/blogs/post/four-sharepoint-vulnerabilities-are-being-actively-exploited-here-s-what-to-doFour SharePoint CVEs are being actively exploited in July 2026. Here's what's affected, how to check your exposure, and what to do this week.]]>

The 14 July 2026 end-of-support deadline for SharePoint Server 2016 and 2019 landed in the same week that four separate SharePoint vulnerabilities were confirmed under active exploitation. If you're running SharePoint on-premise, here's what actually happened, why four CVEs at once is a bigger deal than one, and what to check before the end of this week.

What Happened With SharePoint This Week

CISA confirmed that four separate SharePoint vulnerabilities are being actively exploited in the wild, not just one. That matters because CVEs are sometimes discovered and patched quietly, well before attackers pick them up. Having four confirmed under active exploitation at once, in the same year, signals a much more concentrated wave of attacker interest in SharePoint specifically.


These aren't new bugs introduced by a recent update. They sit in subsystems that have been part of SharePoint since 2016, and they affect every version built on that foundation, including the latest Subscription Edition. AI-assisted vulnerability research is a big part of why these older, previously overlooked issues are surfacing now: it's simply become faster to fuzz code and find these combinations of bugs.

Breaking Down the Two Critical CVEs

CVE-2025-56164: Missing Authentication
​

This was the earlier of the two critical vulnerabilities to surface. It's a missing authentication issue for a critical function, but exploiting it still requires some low-level access to the system. That makes it serious, but it's not the most dangerous of the four.


CVE-2025-58644: Unauthenticated Remote Code Execution

This is the one to worry about. It requires no prior access and no authentication at all. If an attacker knows your SharePoint site exists, they can send crafted requests over the network and remotely execute code. It carries a 9.8 severity rating, close to the maximum possible score, which reflects just how little an attacker needs to exploit it.

Why Stolen IIS Machine Keys Are the Real Danger

Beyond the initial breach, attackers behind these exploits have been stealing IIS machine keys and using them to deploy malware that persists inside the same service that serves your SharePoint environment to your users. In practice, that means malicious code can live in a trusted location and be pushed out to your users directly, potentially harvesting credentials that grant access to completely separate systems beyond SharePoint itself.

Who Is Actually Affected

SharePoint Online is not affected by these vulnerabilities. Microsoft has already patched the online service. This issue is specific to SharePoint on-premise deployments, including SharePoint 2016, 2019, and Subscription Edition. If you're running a version older than 2013, you're already dealing with a separate set of unpatched, unsupported risks.

How to Check Your Exposure

Log in to your SharePoint service and confirm which version and build you're currently running. Then check your Windows Update history for the relevant security KB:


●  SharePoint Subscription Edition: KB5002873

●  SharePoint 2019: KB5002874

●  SharePoint 2016: KB5002880


Microsoft's Security Update Guide also lets you search by CVE number to see exactly which patch resolves which vulnerability for your version.

What to Do This Week

Microsoft released security updates for SharePoint 2016 and 2019 on 14 July 2026 that address these vulnerabilities, even though both versions are officially out of support. Patch immediately using the KB references above. Once patched, start planning your upgrade path, since these platforms won't receive fixes indefinitely.


Beyond patching, review whether your SharePoint environment needs to be publicly accessible at all. If it doesn't need to be reachable from anywhere on the internet, put it behind a VPN. Reducing unnecessary exposure shrinks your attack surface regardless of how quickly you can patch.

Frequently Asked Questions

No. SharePoint Online has already been patched by Microsoft and is not affected by these four CVEs. This is specific to on-premise SharePoint deployments.

SharePoint 2016, SharePoint 2019, and SharePoint Subscription Edition are all affected, since the vulnerable subsystems have been part of SharePoint since 2016.

Yes, for now. Microsoft released security updates for these vulnerabilities on 14 July 2026 despite both versions having reached end of support. This isn't guaranteed to continue, which is another reason to plan an upgrade.

Check your current patch level against the KB references for your version, and apply the 14 July 2026 security update if you haven't already. Then review whether your SharePoint environment is unnecessarily exposed to the public internet.

They let attackers host malware within the same trusted service that delivers SharePoint to your users, which can be used to harvest credentials and gain access to systems well beyond SharePoint itself.

]]>Thu, 23 Jul 2026 10:47:14 +0000<![CDATA[SharePoint 2016 and 2019 Are Now Unsupported. Here's What That Actually Means.]]>https://www.gtconsult.com/blogs/post/sharepoint-2016-and-2019-are-now-unsupported.-here-s-what-that-actually-means.SharePoint Server 2016 and 2019 officially lost Microsoft support on 14 July 2026. Here's what end of support actually means, the real security and compliance risks, and the steps to take now.]]>

Yesterday was the SharePoint end-of-support deadline. Today is the day it becomes real.

As of 14 July 2026, SharePoint Server 2016 and SharePoint Server 2019 have officially reached end of extended support. If your organisation is still running either version, nothing crashed overnight and no one locked you out. Your farm is still up, your sites still load, your documents are still there. That's exactly what makes SharePoint end of support easy to miss and dangerous to ignore.

You can edit text on your website by double clicking on a text box on your website. Alternatively, when you select a text box a settings menu will appear. your website by double clicking on a text box on your website. Alternatively, when you select a text box

What SharePoint end of support actually changed on 15 July 2026

Microsoft has stopped shipping anything for SharePoint 2016 and 2019. Specifically, that means:


  • No more security patches, for any vulnerability discovered from this point forward
    • No bug fixes or performance updates
    • No technical support, not through Premier, Unified, or Pay-Per-Incident channels
    • No official documentation updates on Microsoft Learn

    There is no Extended Security Updates programme for SharePoint, unlike Windows Server or SQL Server. There's no paid safety net to buy more time. Once a new CVE is published against SharePoint 2016 or 2019, it stays open. Permanently.

    Why an unsupported SharePoint environment is a real security risk

    Threat actors monitor for newly disclosed vulnerabilities and actively scan the internet for unpatched SharePoint installations, often within hours of a CVE going public. A SharePoint farm is a large attack surface on its own, IIS, .NET, the search service, the user profile service, plus whatever custom solutions have been layered on over the years. Every one of those is now a standing target with no fix coming.


    Compliance is the other side of this. HIPAA, SOC 2, PCI DSS, and similar frameworks generally treat unsupported production software as an audit finding. Several cyber insurance carriers have already started writing policy exclusions for incidents traced back to end-of-life software. If your SharePoint environment is central to how your business handles documents, workflows, or client data, this is no longer just an IT conversation.

    What to do now that SharePoint 2016 and 2019 are unsupported

    If you're still on 2016 or 2019, the priority list looks like this:


    1. Get visibility fast. Run an assessment of your current farm, what's on it, what depends on it, and what breaks if it goes down.
    2. Decide your path. Broadly, that's SharePoint Online in Microsoft 365, SharePoint Server Subscription Edition if you need to stay on-premises, or a hybrid of the two.
    3. Reduce exposure while you plan. Restrict external access where you can, and harden configurations in the meantime.
    4. Get the licensing and timeline sorted. Migrations typically run 6 to 18 months depending on complexity, so the sooner this starts, the more control you have over the process.


    Missing the deadline doesn't mean starting over. It means the clock on risk is now running, and every week without a plan adds to it.

    Get SharePoint migration help from GTconsult

    We've spent this campaign walking through the deadline, the risks, and the migration paths in detail. If you're past the point of reading about it and ready to actually assess where you stand, that's where we can help. Our migration cost calculator is a quick way to get a sense of scope:

    Get a fast, no obligation estimat with GTconsult's migration cost calculator.
    ]]>    Wed, 15 Jul 2026 12:17:04 +0000