How the SharePoint Chain Broke on July 14, 2026: CVE-2026-56164, End-of-Support, and What Every On-Prem Operator Should Do This Week

Last updated: July 20, 2026 · Author: Zach Carothers · Reading time: 8 minutes

What Is the SharePoint Chain?

Short answer: The SharePoint chain is a coordinated exploitation campaign that stitches together four separate on-premises Microsoft SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644) to achieve unauthenticated remote code execution, steal Internet Information Services machine keys, and deploy Warlock ransomware. It became critical in July 2026 when the newest link, CVE-2026-56164, was disclosed and immediately weaponized.

Individually, each of these flaws is patchable and manageable. Together, they let an attacker skip the login screen entirely, run their own code on a SharePoint server, steal the cryptographic keys Windows uses to sign its own web components, and stay hidden for as long as they choose. Microsoft’s incident responders, working with Google’s threat research team, discovered the newest link in the chain while investigating live attacks against enterprise networks. Not in a lab. In real environments.

Which SharePoint Vulnerabilities Are Being Exploited in July 2026?

Four CVEs are involved. The table below summarizes each one, including CVSS severity score, patch date, and the CISA remediation deadline for federal agencies.

The most severe of the four, CVE-2026-56164, is a missing-authentication weakness in on-premises SharePoint Server 2016, 2019, and Subscription Edition. It allows an unauthenticated network attacker to elevate privilege without touching a login screen. That single flaw does not compromise a server by itself, but it opens the front door of the chain.

Who Is Behind the July 2026 SharePoint Attacks?

Short answer: Microsoft attributes the campaign to three named threat actors. Two are Chinese state-linked intelligence collection groups. One is a financially motivated ransomware actor.

The intelligence collection side is being carried out by Linen Typhoon and Violet Typhoon, both of which Microsoft tracks as China-nexus state actors. The ransomware side belongs to Storm-2603, an actor Microsoft has previously observed deploying Warlock ransomware and LockBit payloads. Post-exploitation activity in the wild has included the use of legitimate remote-access tools like Velociraptor, Cloudflare Tunnels, and Zoho Assist to blend in with normal administrative traffic.

Victims disclosed to date span government, healthcare, finance, education, and critical infrastructure. The pattern of the attack, sector-agnostic and volume-based, indicates opportunistic exploitation of internet-facing SharePoint servers rather than tightly targeted intrusions.

Why Is July 14, 2026 a Perfect Storm for SharePoint?

Short answer: Three consequential events landed on the same date. Microsoft released an out-of-band emergency patch for CVE-2026-56164. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. And Microsoft’s official support window for SharePoint Server 2016 and 2019 ended.

Read those three events together and the picture becomes unmistakable. The same day the door closed on future security updates for the two most widely deployed on-premises SharePoint versions, an actively exploited flaw affecting those same versions became public and got a 72-hour federal remediation clock attached to it.

For an on-premises operator, this collapses to two possible states. Either the July 14 patch was installed before attackers found the server, in which case the door is closed. Or it was not, in which case the environment is now running unsupported, unpatched, actively targeted software that faces the public internet. There is no third option.

What Are Regulators Saying? CISA, NCUA, and HIPAA Implications

CISA, the federal cybersecurity agency, added CVE-2026-56164 to its Known Exploited Vulnerabilities catalog on July 14, 2026 and set a remediation deadline of July 17, 2026 for all Federal Civilian Executive Branch agencies. That three-day patch window is unusually aggressive and signals CISA’s assessment of exploitation velocity in the wild.

The tempo does not stay federal. Examiners covering credit unions under National Credit Union Administration (NCUA) guidance, healthcare organizations under U.S. health-privacy law (HIPAA), financial institutions under state cybersecurity rules, and defense contractors under Cybersecurity Maturity Model Certification (CMMC) requirements will start asking the same three questions in the next audit cycle. Did you know about the vulnerability? When did you know? What did you do about it?

A missed patch on unsupported software creates a documented compliance question with a paper trail attached. For any regulated organization, the incident response documentation for this specific chain is now a mandatory artifact.

How to Respond: The Five-Step SharePoint Emergency Playbook

If SharePoint Server is anywhere in your environment, execute the following five actions this week. In order.

1. Confirm patch state on every SharePoint instance. Not just the servers your IT team remembers. Include forgotten test environments, retired subsidiary infrastructure, and any hosted SharePoint farm managed by a third-party provider. Verify the July 14, 2026 out-of-band patch is applied.
2. Rotate Internet Information Services machine keys. The exploit chain specifically targets IIS machine keys for persistence. Rotating those keys after patching is the only way to invalidate any keys attackers may already hold. Patching alone does not evict a foothold.
3. Hunt for post-exploitation indicators. Look for unexplained instances of Velociraptor, Cloudflare Tunnels, Zoho Assist, or SSH via Visual Studio Code on SharePoint hosts and adjacent servers. Any of the four indicate potential Storm-2603 activity.
4. Inventory all on-prem software against end-of-support dates. SharePoint Server 2016 and 2019 hit end of support on July 14, 2026. Identify every other platform in your environment with an announced or overdue end-of-support date.
5. Choose a migration path. Options are SharePoint Online, SharePoint Server Subscription Edition (still supported), or a hybrid model. Every path involves work. Doing nothing is not one of the paths.

For most mid-market teams, that list represents a real week of work. It is also the exact category of work where a managed security service provider, a dedicated virtual CISO on retainer, or an experienced incident response partner changes the outcome. Not because the steps are secret, but because someone needs to own them, sequence them, and produce documentation an examiner will accept.

What This Means for Every On-Prem Platform in Your Environment

The SharePoint chain is not an isolated event. It is the second time in twelve months that a mainstream on-premises Microsoft platform has been end-of-lifed inside an active exploitation window. The 2025 ToolShell campaign against these same SharePoint versions established the pattern. The July 2026 chain confirmed it.

Every mid-market environment has a version of this same setup somewhere. Legacy Exchange servers. Older VPN appliances. File transfer utilities. Time-tracking systems. Any critical business system where the vendor has posted an end-of-support date and the operator has quietly hoped the deadline would move.

Attackers read those dates too. They watch end-of-support calendars, stockpile exploits, and time their campaigns to the moment monthly patches stop shipping. The pool of stationary targets expands. The moment is now for building an inventory before the next chain lands.

Frequently Asked Questions

What is CVE-2026-56164?

CVE-2026-56164 is a missing-authentication vulnerability in on-premises Microsoft SharePoint Server 2016, 2019, and Subscription Edition. It has a CVSS score of 9.8. An unauthenticated attacker can exploit it over the network to elevate privileges without valid credentials. Microsoft patched it on July 14, 2026 in an out-of-band security release.

Is SharePoint Server 2019 still supported after July 14, 2026?

No. Microsoft ended mainstream and extended support for SharePoint Server 2016 and SharePoint Server 2019 on July 14, 2026. These versions no longer receive security updates. SharePoint Server Subscription Edition remains supported. Organizations still running the 2016 or 2019 versions face escalating security and compliance risk.

How is the July 2026 SharePoint chain different from the 2025 ToolShell campaign?

Both campaigns target on-premises SharePoint Server and use similar techniques, including IIS machine key theft. ToolShell (July 2025) chained CVE-2025-53770 and CVE-2025-53771. The July 2026 chain involves four different CVEs (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644) and coincides with SharePoint on-premises end of support, making the impact substantially larger for the mid-market.

Who is Storm-2603?

Storm-2603 is a threat actor tracked by Microsoft Threat Intelligence. Microsoft has previously observed the group deploying Warlock ransomware and LockBit payloads. In the July 2026 SharePoint campaign, Storm-2603 is chaining SharePoint vulnerabilities to gain access, steal Internet Information Services machine keys, and deploy ransomware.

How do I know if my SharePoint server was compromised?

Indicators of compromise include unexplained instances of legitimate remote-access tools (Velociraptor, Cloudflare Tunnels, Zoho Assist, SSH via Visual Studio Code) on SharePoint hosts, unusual authentication events, suspicious IIS machine key activity, and unexpected outbound network connections. If your team lacks the tooling to hunt for these indicators, engage an incident response partner before assuming the environment is clean.

Should I migrate SharePoint on-premises to SharePoint Online?

For most organizations without a specific regulatory or sovereignty requirement to keep data on-premises, yes. Cloud beats on-premises on total cost after year one for the majority of organizations. If migration is not immediately feasible, SharePoint Server Subscription Edition is the supported on-premises path forward. Doing nothing exposes the environment to future chains built on the same pattern.

What is the CISA remediation deadline for CVE-2026-56164?

CISA added CVE-2026-56164 to its Known Exploited Vulnerabilities catalog on July 14, 2026 and set a remediation deadline of July 17, 2026 for all Federal Civilian Executive Branch agencies. Private-sector organizations are strongly encouraged to meet the same deadline.

About TorchLight

TorchLight is a Secured & Managed IT provider focused on making cybersecurity an enabler of every next opportunity. Our team delivers 24×7 monitoring, detection and response, virtual CISO services, and incident response for regulated mid-market organizations. Our tagline: Risk Aligned. Reward Defined.

Sources

1. CISA Alert: Urges SharePoint Hardening After New Exploitations (July 14, 2026)
2. The Hacker News: CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
3. The Hacker News: SharePoint RCE CVE-2026-45659 Added to CISA KEV
4. Tenable: SharePoint CVEs FAQ (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164)
5. Microsoft Security Blog: Disrupting Active Exploitation of On-Premises SharePoint Vulnerabilities
6. The Register: CISA Sounds Alarm Over Trio of Exploited SharePoint Flaws
7. CISA Known Exploited Vulnerabilities Catalog
8. NVD: CVE-2026-56164 Detail