Same vulnerability, two official severity scores that don't agree: Microsoft rates CVE-2026-56164 a 5.3, the National Vulnerability Database a 9.8. It's a zero-day being exploited right now. Here's who's right, and what to do.
Here's a problem that should bother anyone who patches for a living. Microsoft looked at CVE-2026-56164, a flaw in its own SharePoint Server, and rated it 5.3 — 'Moderate.' The National Vulnerability Database looked at the same bug and rated it 9.8 — 'Critical.' That's not a rounding difference; it's the gap between 'we'll get to it' and 'drop everything.' And while the two scores argue, attackers have settled the question themselves: it's a zero-day already being exploited in the wild. If your patch queue is sorted by vendor severity, this is the bug that quietly sits near the bottom while someone walks into your SharePoint.
Why the two scores disagree
The disagreement isn't sloppiness — it's a genuine difference in how the impact was judged, and it's worth understanding because it recurs. Both scores agree on the attack: network vector, low complexity, no privileges required, no user interaction. Where they split is impact. Microsoft's vector (C:N/I:L/A:N) says the bug leaks a little integrity and nothing else — no confidentiality loss, no availability loss. The NVD's vector (C:H/I:H/A:H) says it fully compromises confidentiality, integrity and availability. One of those describes a nuisance; the other describes a takeover.
Vendors sometimes score conservatively — rating the narrowest demonstrable impact rather than the worst plausible one — while the NVD tends to score the realistic worst case for a missing-authentication flaw on a server that holds an organisation's documents. I lean toward the NVD read here, and not just on principle: a bug nobody could seriously exploit doesn't get used as a zero-day. The in-the-wild exploitation is the tiebreaker. When reality is actively demonstrating 'Critical,' a spreadsheet cell that says 'Moderate' is the wrong thing to trust.
Microsoft's own advisory: 'Max Severity: Moderate,' CVSS 5.3. The NVD scored the identical bug 9.8. Only one of them matches how it's being used. · Microsoft Security Response Center (screenshot)
What the vulnerability lets an attacker do
The technical class is CWE-306: missing authentication for a critical function. In plain terms, a function that should require you to prove who you are doesn't check. The NVD description is blunt: an unauthorised attacker can elevate privileges over a network. On an internet-facing or intranet SharePoint server — which holds contracts, HR files, internal wikis, whatever your organisation keeps there — privilege escalation is the foothold that turns 'anonymous request' into 'authenticated insider,' and from there into the rest of your environment. SharePoint has been a favoured target precisely because it sits at the centre of so much sensitive data.
CVE-2026-56164 at a glance
Microsoft (CNA) score
Detail
5.3 — Moderate
NVD score
Detail
9.8 — Critical
Weakness
Detail
CWE-306: missing authentication
Attack profile
Detail
Network, no auth, no interaction
Exploited in wild
Detail
Yes — zero-day
Affected
Detail
SharePoint 2016 / 2019 / Subscription Edition
Fixed
Detail
July 14, 2026 security update
Detail
Microsoft (CNA) score
5.3 — Moderate
NVD score
9.8 — Critical
Weakness
CWE-306: missing authentication
Attack profile
Network, no auth, no interaction
Exploited in wild
Yes — zero-day
Affected
SharePoint 2016 / 2019 / Subscription Edition
Fixed
July 14, 2026 security update
What to do
Confirm your SharePoint build against the patched versions above — anything below the listed builds is vulnerable.
Apply the July 2026 security update now. This is on-prem SharePoint; SharePoint Online (Microsoft 365) is Microsoft's to patch, not yours.
Ensure AMSI integration is enabled — Microsoft notes it can detect the malicious POST requests this exploit uses, buying protection if you can't patch this hour.
Hunt for prior compromise: it's a zero-day, so review authentication and access logs for anomalous privilege changes before you assume patching is enough.
Quick answers
Does this affect SharePoint Online / Microsoft 365?
No — this is an on-premises SharePoint Server flaw (2016, 2019, Subscription Edition). If you use SharePoint Online through Microsoft 365, Microsoft patches its own cloud infrastructure and there's nothing for you to install. The urgency is for organisations running their own SharePoint servers, which are the ones exposed to this network-based, unauthenticated attack.
Which score should I actually believe, 5.3 or 9.8?
For prioritisation, treat it as the 9.8. The scores disagree on impact, but a missing-authentication flaw on a document server that's being exploited in the wild behaves like a critical bug regardless of the vendor's conservative rating. The safe move is to assume the worse score is right and act accordingly — under-reacting to an exploited zero-day is the expensive mistake.
Can AMSI protect me instead of patching?
Partially, not fully. Microsoft notes its Antimalware Scan Interface integration can scan for and detect the malicious POST requests this exploit relies on, which is useful mitigation if you genuinely can't patch immediately. But it's a detection layer, not a fix — the underlying missing-authentication flaw remains until you apply the July update. Use AMSI as a stopgap, then patch.
How does this compare to the AD FS zero-day patched the same day?
CVE-2026-56155 in Active Directory Federation Services was the other actively-exploited zero-day in the same July release — an elevation-of-privilege flaw that grants administrator rights, rated 7.8. Both were caught being used in the wild and both should be top of your patch list. If you run AD FS and on-prem SharePoint, that's two emergencies from one Patch Tuesday.
