The Patch is Out. The Server is Still Open.

# The Patch is Out. The Server is Still Open. If you run a ten-person shop, you probably don't have a server room. You have a ventilated closet or a dusty corner of the office where a piece of hardware hums loudly and smells like warm electronics. Somewhere in that closet, or perhaps in a cloud instance you've forgotten how to manage, sits a Microsoft SharePoint Server. For the enterprise, a vulnerability like CVE-2026-56164 is a ticket in a Jira queue. They have a dedicated team to scan for the flaw, a staging environment to test the patch, and a compliance officer to sign off on the risk. For you, it's a gamble. You know that if you update the server on a Tuesday, you might spend Wednesday morning explaining to your accountant why the shared drive is gone. That's why many small firms just don't patch. They hope they're too small to be noticed. This week, the data says that's a bad bet. CVE-2026-56164 has appeared in 9 separate reports this week alone. It's a "Missing Authentication for Critical Function" flaw. In plain English: there is a door to a sensitive part of your server that should be locked with a heavy bolt, but instead, it's just a curtain. Anyone who knows where the curtain is can walk right in and execute commands. CISA added this to the Known Exploited Vulnerabilities (KEV) list on 2026-07-14. The federal deadline to patch it was 2026-07-17. If you're reading this on the 18th, you're already behind the clock. The exploitation is boringly efficient. Attackers aren't using complex social engineering or fancy phish. They're just scanning the open web for SharePoint servers that haven't been updated. Once they find one, they use the missing authentication to get a foothold. From there, they aren't just stealing your PDF invoices; they're looking for a way into the rest of your network. The problem is that patching SharePoint is rarely a one-click affair. It often requires a series of updates, a reboot, and occasionally a prayer that the configuration doesn't reset to factory defaults. It's an unglamorous, tedious process that offers no immediate reward other than the absence of a disaster. Some of you will tell me that your server isn't exposed to the public internet. You've got a firewall. You've got a VPN. You're safe. You aren't. Firewalls are great until a single employee's laptop is compromised via a malicious npm package or a browser exploit. Once an attacker is inside your perimeter, they aren't going to try and crack your passwords first. They're going to look for the easiest path to admin rights. An unpatched SharePoint server is a neon sign pointing the way. It's the path of least resistance. This is where the second-order effects hit. If your SharePoint server is compromised, the attacker doesn't just have your files. They have a trusted platform from which to launch attacks against your clients. If you're a small accounting firm or a boutique law office, your SharePoint server likely holds the keys to your customers' kingdom. An attacker can use your trusted identity to send "updated invoice" emails to your clients, containing malware that looks like it's coming from a source they trust. You become the delivery mechanism for the next breach. We saw this play out with the SharePoint RCEs a few years back. The pattern is identical. The vendor releases a patch, the enterprises deploy it within 48 hours, and the small shops wait until they see a ransom note on their screen. The only difference now is the speed. The gap between a CVE being published and the first active scan hitting a random IP address has shrunk from weeks to hours. The cost gap here is staggering. An enterprise spends hundreds of thousands of dollars on tooling to ensure they aren't vulnerable to CVE-2026-56164. You can't afford that. But you can afford the time it takes to run a Windows Update and check your logs. I don't believe in "security posture." That's a word for people who sell consultants' hours. I believe in boring controls. Boring controls are the things that actually work when the world is on fire. MFA on every single account, offline backups that aren't connected to the main network, and patching the gear that faces the internet. If you're running SharePoint on-prem, you're essentially volunteering to be a full-time system administrator. If you don't have the time or the appetite for that, the most practical move isn't a new firewall—it's moving the data to a managed service where the patching is someone else's headache. But since you're likely still running that server in the closet, you have a choice. You can spend the next hour updating the software, or you can spend the next month wondering why your client list is being sold on a forum for 2.00 USD per record. The attackers aren't targeting you because you're special. They're targeting you because you're an easy win. One thing to check this week: Log into your router or firewall and look for any "DMZ" settings or port forwards pointing to your SharePoint server. If you see port 80 or 443 open to a server you haven't patched since June, close them before you do anything else.