
CVE-2026-56164 EOP Exploit
Functional unauthenticated EOP exploit.
Missing authentication for critical function (CWE-306) in SharePoint Server user profile and site collection endpoints. Allows remote attackers to escalate from anonymous to Site Collection Administrator / Farm Admin level.
Bypasses auth gate via crafted SOAP payload on /_vti_bin/client.svc.
Insufficient SPContext validation in Microsoft.Office.Server.UserProfiles when X-RequestDigest is omitted with specific header chain.
python3 cve-2026-56164.py -t https://target.sharepoint.site
Only -t (target) required. Optional: -u (custom username), -p (custom password).
What the exploit does:
This tool is provided for educational and authorized red team / penetration testing purposes only. The author is not responsible for any misuse, damage, or illegal activity caused by this exploit. Use at your own risk and only on systems you have explicit permission to test.