1. Alert
2. Audience
3. Purpose
4. Details
5. Suggested actions
6. References
7. About the Cyber Centre
8. Support

Number: AL26-017

This alert is intended for IT professionals and managers.

An alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security (“Cyber Centre”) is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

The Canadian Centre for Cyber Security (Cyber Centre) is aware of critical vulnerabilities affecting Microsoft SharePoint Server. In response to the Microsoft security advisory, released on July 14, 2026 [1], the Cyber Centre issued AV26-698 [2] on July 14, 2026.

Tracked as CVE-2026-55164 [3], this vulnerability is a Missing Authentication for Critical Function (CWE-306) [4] vulnerability affecting multiple versions of Microsoft SharePoint Server, that could allow an unauthorized attacker to elevate privileges over a network.

Tracked as CVE-2026-55040 [5][6], this vulnerability is a Weak Authentication (CWE-1390) [7] vulnerability affecting multiple versions of Microsoft SharePoint Server, that could allow an unauthorized attacker to bypass a security feature over a network.

Tracked as CVE-2026-58644 [8], this vulnerability is a Deserialization of Untrusted Data (CWE-502) [9] vulnerability affecting multiple versions of Microsoft SharePoint Server, that could allow an unauthorized attacker to execute code over a network.

Microsoft is aware of exploitation of CVE-2026-56164 and other previously released SharePoint related vulnerabilities. CVE-2026-56164 was added to the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog [10] on July 14, 2026.

The Cyber Centre recommends that organizations upgrade affected Microsoft SharePoint instances to a fixed version:

The Cyber Centre recommends organizations:

• Identify all on-premises SharePoint Server instances, particularly those exposed to the internet.
• Use or upgrade to supported versions of on-premises Microsoft SharePoint Server.
• Apply the latest security updates from Microsoft to all affected SharePoint Servers including (Subscription Edition, 2019, and 2016).
• Monitor SharePoint servers for suspicious activity, including unusual requests, web shells, malicious processes, unauthorized access attempts, and machine key theft indicators.
• Harden SharePoint Deployments:
  • Enable Antimalware Scan Interface (AMSI) integration for SharePoint web applications.
  • Configure AMSI Request Body Scan Mode to Full Mode where operationally feasible.
  • Restrict or eliminate direct Internet exposure of SharePoint servers whenever possible.
  • Limit access to SharePoint Central Administration and management interfaces.
• Monitor for Indicators of Compromise
  • Organizations should closely monitor SharePoint environments for:
    • Unexpected privilege escalation activity.
    • Unauthorized authentication attempts.
    • Suspicious IIS machine key access.
    • Evidence of deserialization attacks or web shell deployment.
    • Microsoft Defender and AMSI detections related to SharePoint exploitation activity.

In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions with an emphasis on the following topics [13].

• Patch operating systems and applications
• Harden operating systems and applications
• Isolate web-facing applications

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal or email contact@cyber.gc.ca.

1. July 2026 security updates
2. Microsoft security advisory – July 2026 monthly rollup (AV26-698)
3. CVE-2026-55164
4. CWE-306: Missing authentication for critical function
5. CVE-2026-55040
6. CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)
7. CWE-1390: Weak authentication
8. CVE-2026-58644
9. CWE-502: Deserialization of untrusted data
10. CISA KEV: CVE-2026-56164
11. SharePoint Server 2016 – Microsoft Lifecycle
12. SharePoint Server 2019 – Microsoft Lifecycle
13. Top 10 IT security actions to protect Internet connected networks and information (ITSM.10.089)

The Canadian Centre for Cyber Security (Cyber Centre) operates as part of the Communications Security Establishment. We are Canada’s national authority on cyber security, and we lead the government’s response to cyber security events. As Canada’s national computer security incident response team, the Cyber Centre works in close collaboration with government departments, critical infrastructure, Canadian businesses, and international partners to prepare for, respond to, mitigate, and recover from cyber events. We do this by providing authoritative advice and support and coordinating information sharing and incident response. The Cyber Centre is outward-facing, welcoming partnerships that help build a stronger, more resilient cyber space in Canada.

As always, please let us know if you have any questions or concerns or see unusual activity on your systems that you believe might be associated with this or any other vulnerability. Please send these communications to security.response@utoronto.ca.