본문으로 이동
ONEPRESS

TECHNOLOGY

Microsoft confirms active exploitation in SharePoint Server and AD FS. Move these patches to the front

Technology briefing
Briefings by language
KO 한국어 EN English JA 日本語 ZH 简体中文 ES Español VI Tiếng Việt
Two IT staff check a server rack and management screens in a bright public-service computer room
A ONEPRESS technology and public-safety image focused on verifying server updates in a real operations setting.
  • Checked: 2026-07-15 14:16 KST
  • Basis: Microsoft’s July 14 security update data and CISA’s KEV catalog updated the same day

This should not wait for the next routine maintenance window merely because one score looks moderate. Microsoft marked CVE-2026-56164 in SharePoint Server and CVE-2026-56155 in Active Directory Federation Services (AD FS) as exploited in the wild on July 14. CISA added both to its Known Exploited Vulnerabilities catalog the same day.

Both are privilege-escalation flaws, but their prerequisites differ. The SharePoint issue can be reached over a network by an unauthenticated attacker with low complexity and no user interaction. The AD FS issue requires an authorized low-privilege attacker with local access, but Microsoft says successful exploitation can yield administrator privileges.

Confirmed exploitation does not mean every server is compromised; it means the remediation order must change. Public agencies, schools, healthcare providers and businesses that host these services should handle inventory, patching, exposure reduction and evidence preservation as one task.

What is being exploited

  • CVE-2026-56164: missing authentication for a critical SharePoint Server function. Its CVSS base score is 5.3, yet exploitation is confirmed. CISA set July 17 as the U.S. federal civilian-agency due date.
  • CVE-2026-56155: insufficiently granular AD FS access control can let an authorized local attacker reach administrator privileges. Its CVSS base score is 7.8; CISA’s federal due date is July 28.
  • Those dates bind U.S. federal civilian agencies, not every organization worldwide. They are still a useful urgency signal for any operator of the affected products.

Separate the affected environments first

  • SharePoint: Microsoft lists SharePoint Enterprise Server 2016, SharePoint Server 2019 and SharePoint Server Subscription Edition. SharePoint Online is not listed as an affected product in this advisory.
  • AD FS: Microsoft lists Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus some Windows 10 long-term servicing builds. Confirm whether the AD FS role or related components are actually deployed.
  • Personal devices: a household using Microsoft 365 without hosting SharePoint Server or AD FS does not install these server patches. Ask the organization that manages the work or school account.

Six steps for today

  1. Fix the inventory and owner: list every on-premises SharePoint farm and AD FS server with version, public address, exposure and responsible team or provider.
  2. Patch SharePoint first: Microsoft provides KB5002891 for 2016, KB5002883 for 2019 and KB5002882 for Subscription Edition. Follow the matching official instructions, back up, install, and verify farm build and health.
  3. Use AMSI as reinforcement: Microsoft recommends active AMSI integration for SharePoint and IIS worker memory with Request Body Scan set to Full. It complements rather than replaces the security update.
  4. Update AD FS hosts: apply the July Windows security update that matches the server version. Microsoft flags a restart, so check redundancy, maintenance timing and rollback before proceeding.
  5. Preserve evidence and review recent activity: retain IIS, SharePoint, Windows event, authentication and administrative logs. Unusual logins, privilege changes, new administrators or unexpected management activity require incident response, not only patch closure.
  6. Validate after installation: test SharePoint search, upload and sign-in, plus AD FS sign-in and token issuance. Record the KB, time, owner and user-path test for every server.

What users and service providers should check

  • Employees and students do not patch this by clicking a message or resetting passwords at an unsolicited link. Use only the official portal and help desk.
  • Managed-service providers should report the affected server list, installed KB, completion time, restart and service-test results—not simply say that automatic updates are enabled.
  • If a management interface is directly internet-facing, review VPN, access controls and allowlists separately from patching. Confirm service impact and recovery before emergency blocking.

How to read the alert without overstatement

  • Do not let the SharePoint score of 5.3 or “Moderate” override confirmed exploitation and an unauthenticated network path.
  • Microsoft’s exploitation finding is not proof that a particular organization has been breached; asset and log evidence are still required.
  • Do not confuse SharePoint Online with on-premises SharePoint Server or instruct cloud-only users to install a server KB.
  • AMSI alone does not replace the patch, and patching alone does not rule out earlier compromise.

Primary sources

Bottom line: If you run SharePoint Server or AD FS, identify the exact product now, prioritize the SharePoint update, and close the task only after AMSI, logs and user-path service tests are checked.