Active SharePoint Zero-Day Exploitation: What York County SMBs Need to Know Now

What happened

On July 14, 2026, Microsoft shipped its largest-ever Patch Tuesday. Microsoft addressed 622 vulnerabilities in its July 2026 security update release — roughly triple the number in June — including fixes for two exploited zero-day vulnerabilities, one publicly disclosed zero-day, and 62 Critical vulnerabilities.

The one to worry about is CVE-2026-56164, a SharePoint Server flaw. It is a missing-authentication vulnerability in on-premises SharePoint Server — covering SharePoint Server 2016, 2019, and the Subscription Edition — that allows an unauthenticated attacker to escalate privileges over the network. No credentials. No user interaction. Remote.

Microsoft initially rated it "Moderate" at 5.3, but the National Vulnerability Database independently scored it 9.8 — Critical. Translation: an attacker doesn't need to phish anyone or steal a password. If your SharePoint server is reachable from the internet, they can walk in.

CISA followed up almost immediately. CISA is aware of active exploitation of vulnerabilities CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644, enabling cyber threat actors to gain unauthorized access to on-premises SharePoint Server instances. These vulnerabilities involve establishing remote code execution and post-exploitation activities, such as stealing IIS machine keys and performing deserialization techniques, to gain persistence and deploy malware.

Why this matters for a small business in York County

Most York County small businesses run Microsoft 365 in the cloud, and the good news is that SharePoint Online is not affected by this bug. But plenty of local firms — law offices, accounting practices, engineering shops, manufacturers with document portals — still run SharePoint on a server in a closet or a co-location facility. Some inherited it from an old IT setup and forgot it was even there.

That's the danger. SharePoint Server 2016 and 2019 reached end-of-extended-support on July 14, 2026, the very day this patch shipped, so organizations still on those versions are patching a product that is otherwise out of support. If nobody is actively managing that server, it is almost certainly exposed.

And this isn't a theoretical chain. The combination is dangerous: paired with a remote code execution vulnerability it makes for a ransomware delivery chain. An attacker who achieves code execution on a networked system can then pivot, escalate to administrator, and from that position forge tokens for the entire federated estate. In small-business terms: one unpatched server, and the attacker owns your file shares, email identities, and backups.

What your managed IT provider should already be doing

If you're paying for a managed IT provider — or you use York Computer's managed IT and cybersecurity services — this week's checklist is not optional:

1. Inventory. Confirm in writing whether your business (or any vendor holding your data) runs on-premises SharePoint Server 2016, 2019, or Subscription Edition. "We're on Microsoft 365" is not the same answer.

2. Patch immediately. The July fixes are KB5002882 for Subscription Edition, KB5002883 for SharePoint Server 2019, and KB5002891 for SharePoint Enterprise Server 2016.

3. Turn on the mitigation. Verify that Antimalware Scan Interface (AMSI) integration is enabled for each SharePoint web application. Follow Microsoft's guidance to ensure proper configuration and select the "Full Mode" option for the Request Body Scan Mode, where feasible.

4. Assume breach and hunt. Patching does not undo an intrusion that already happened. Before rotating IIS machine keys, hunt for and remediate any intrusion artifacts, including machine-key harvesters, that could allow for the keys to be stolen again. Establish tailored logging mechanisms to detect and monitor exploitation activities. Review telemetry for anomalous requests, suspicious SharePoint worker-process activity, webshells, and machine-key access.

5. Get it off the public internet. Avoid exposing SharePoint Servers directly to the internet unless necessary; and if necessary, only configure a SharePoint Server behind a Layer 7 reverse proxy or equivalent application-layer security control that requires authentication.

If you have an in-house IT person handling this alone, they are being asked to do a full incident-response playbook against an active nation-state-caliber threat while also answering the help desk. That is exactly the scenario co-managed IT support exists for.

The bigger pattern

This is not a one-off. SharePoint has now had two separate exploited zero-days in five weeks. AD FS and SharePoint sit at the center of enterprise trust chains: identity federation and document collaboration are exactly the platforms that give an attacker broad lateral reach once compromised.

Expect more Microsoft server-side flaws to hit the CISA Known Exploited Vulnerabilities list in the coming weeks. The businesses that survive this cycle without a call to a ransomware negotiator are the ones whose IT provider is treating "patch within days" as a baseline, not a project.

What York Businesses Should Do

If your York County business has ever hosted a document portal, intranet, or internal SharePoint site on your own server — even one you haven't logged into in years — get someone to look at it this week. Same goes for asking your vendors and outsourced accountants what they run; a breach at their SharePoint becomes your data breach notification.

Sources

• CISA Urges SharePoint Hardening After New Exploitations
• CISA Adds Four Known Exploited Vulnerabilities to Catalog
• Microsoft Patches 622 CVEs: Active SharePoint and AD FS Zero-Days Demand First Action
• Microsoft July 2026 Patch Tuesday Addresses Exploited SharePoint Vulnerabilities
• July 2026 Patch Tuesday: Updates and Analysis (CrowdStrike)
• Microsoft July Patch Tuesday Fixes AD FS and SharePoint Zero-Days