TL;DR: Microsoft's July 14, 2026 Patch Tuesday shipped 622 CVEs, the largest single release in company history, and inside it were multiple actively exploited zero-days in on-premises Microsoft SharePoint Server. CISA confirmed active exploitation of CVE-2026-56164, CVE-2026-32201, and CVE-2026-45659 across SharePoint Server 2016, 2019, and Subscription Edition. CVE-2026-56164 is a missing-authentication flaw that lets an unauthenticated attacker escalate privileges over the network with no account and no user interaction, and while Microsoft scored it 5.3, the National Vulnerability Database independently rated it 9.8 Critical. If your North Carolina business still runs a SharePoint server in a closet or a rack at your High Point, Greensboro, or Charlotte office, assume it is being scanned right now.
Key takeaway: On-premises SharePoint is now a recurring zero-day target, hit in back-to-back summers (the 2025 "ToolShell" wave and again in July 2026). For most NC small businesses the durable fix is not another emergency patch cycle; it is retiring the on-prem farm and moving to SharePoint Online in Microsoft 365, where Microsoft owns the patching. Until then: patch within hours, rotate machine keys, deploy managed detection, and put the server behind identity-aware access.
Need an emergency SharePoint exposure check this week? Contact Preferred Data Corporation at (336) 886-3282 for a rapid on-prem server risk assessment. BBB A+ rated, serving High Point, Greensboro, Winston-Salem, Charlotte, Raleigh, and the Piedmont Triad since 1987.
What exactly is happening with SharePoint Server in July 2026?
Attackers are actively exploiting three confirmed vulnerabilities in on-premises SharePoint Server to run code and steal data before organizations can patch. Microsoft released fixes on July 14, 2026 for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.
- CVE-2026-56164 is the most dangerous of the set: a missing-authentication vulnerability that allows an unauthenticated attacker to escalate privileges over the network. The attack requires no existing account, no user interaction, and low attack complexity. Microsoft assigned a CVSS of 5.3, but the National Vulnerability Database independently scored it 9.8, Critical.
- CVE-2026-32201 and CVE-2026-45659 were also confirmed by CISA as actively exploited and were added to the Known Exploited Vulnerabilities (KEV) catalog, which sets mandatory federal remediation deadlines and functions as an early-warning list for everyone else.
- CISA issued a dedicated SharePoint hardening alert on July 14, 2026, urging all on-premises operators to patch immediately and rotate cryptographic material, because the exploitation pattern mirrors the 2025 ToolShell campaign that breached federal agencies, universities, and energy companies.
This is not a theoretical, wait-for-proof-of-concept situation. Exploitation preceded or coincided with the patch, which is the definition of a zero-day.
Why does an on-prem SharePoint server put a small business at outsized risk?
Because a SharePoint server is usually the single most content-rich system a small business runs, and it is often the least maintained. It typically holds contracts, HR files, financials, engineering drawings, and customer records, and it frequently sits on an aging Windows Server that nobody wants to touch.
Three realities make this worse for the typical NC SMB:
- Patch latency. Enterprises patch SharePoint in hours; many small businesses take weeks, and the 2026 Verizon Data Breach Investigations Report found 31% of breaches now start with an unpatched vulnerability, disproportionately in edge-facing systems.
- Machine-key persistence. In the SharePoint attack chain, once an attacker extracts the server's ASP.NET machine keys they can forge trusted requests and keep access even after you patch. Patching alone does not evict them; you must rotate the keys and restart, a step many teams miss.
- Ransomware follow-on. Ransomware was involved in 48% of breaches in the 2026 DBIR, and 96% of ransomware victims were SMBs. An internet-reachable SharePoint RCE is exactly the foothold a ransomware crew wants.
Key takeaway: Patching a compromised SharePoint server without rotating its machine keys leaves the back door open. Assume-breach handling, not just patch-and-move-on, is the correct posture for any farm that was internet-reachable during the exposure window.
Should NC small businesses keep patching on-prem SharePoint or migrate to SharePoint Online?
For most NC small businesses, the strategic answer is migration to SharePoint Online in Microsoft 365, because it moves the patching burden to Microsoft and removes an internet-facing server you have to defend every month. On-prem SharePoint has now been a marquee zero-day target in two consecutive summers, and each event demands the same emergency scramble.
The following comparison lays out the decision the way we walk NC clients through it.
| Factor | On-Prem SharePoint Server | SharePoint Online (Microsoft 365) |
|---|---|---|
| Who patches the platform | You (within hours, every month) | Microsoft (automatic) |
| Internet-facing attack surface | High (server exposed) | Managed by Microsoft, identity-gated |
| July 2026 zero-day exposure | Directly affected | Not affected by on-prem CVEs |
| Typical ransomware entry risk | Elevated (edge RCE) | Lower (no self-hosted server) |
| Cost model | Server hardware, licenses, labor | Per-user subscription |
| Best fit | Rare data-residency or legacy-integration needs | Most NC SMBs |
Migration is not always instant, and some manufacturers in the Piedmont Triad have legacy line-of-business integrations tied to an on-prem farm. That is precisely why the near-term hardening steps below matter even if you choose to migrate.
Ready to scope a SharePoint Online migration for your NC business? Call Preferred Data Corporation at (336) 886-3282 or explore our Cloud Solutions and Managed IT Services.
What should NC SMBs do this week to defend an on-prem SharePoint server?
Run five actions in parallel, all achievable inside a standard managed-IT engagement, and treat any internet-reachable farm as potentially already compromised.
- Patch immediately. Apply the July 14, 2026 SharePoint security updates for your exact version (2016, 2019, or Subscription Edition). Confirm the build number after patching.
- Rotate ASP.NET machine keys and restart IIS. This is the step that evicts an attacker who already stole your keys. Patching without key rotation is not remediation.
- Take the server off the open internet. Put SharePoint behind a VPN, a reverse proxy with authentication, or identity-aware access so unauthenticated requests never reach it directly.
- Deploy managed detection and response (MDR). Alert on web-shell drops in SharePoint layouts directories, anomalous w3wp.exe child processes, and unexpected outbound connections. These are the observable tells of the SharePoint attack chain.
- Verify backups are immutable and restorable. Confirm you have offline or immutable backups and that you have actually test-restored them, so a ransomware follow-on cannot destroy your recovery path.
If you do not have the in-house staff to do all five within days, that gap is the real risk. This is the core of what a managed cybersecurity partner delivers.
What are the compliance and cyber-insurance consequences for NC businesses?
An unpatched, internet-facing SharePoint server touches three things at once: regulatory breach-notification duties, HIPAA obligations for healthcare-adjacent firms, and your cyber-insurance renewal. Each has become materially stricter in 2026.
- NC breach notification. Under N.C.G.S. Section 75-65, a compromise of North Carolina residents' personal information triggers notice obligations. A SharePoint farm holding customer or employee PII squarely qualifies.
- HIPAA exposure. For medical practices, dental groups, and behavioral-health offices across Raleigh, Charlotte, and Greensboro, an RCE on a system holding ePHI is a reportable event under HHS Office for Civil Rights rules, with a 60-day maximum notification window.
- Cyber-insurance attestations. 2026 renewals routinely require attestation on timely patching, MDR coverage, and tested backups. A known-exploited, unpatched CVE on a production server is exactly the kind of fact insurers use to dispute or reduce a claim.
The pragmatic path: patch and harden this week, document the remediation, and use that evidence packet in your Q4 insurance renewal. NC professional-services firms can review sector-specific exposure on our Professional Services industry page.
Ready to close your on-prem exposure before it becomes a breach? Contact Preferred Data Corporation at (336) 886-3282. Serving the Piedmont Triad since 1987, BBB A+ rated.
Frequently Asked Questions
Is Microsoft 365 SharePoint Online affected by the July 2026 CVEs?
No. The July 2026 vulnerabilities (CVE-2026-56164, CVE-2026-32201, CVE-2026-45659) affect on-premises SharePoint Server 2016, 2019, and Subscription Edition. SharePoint Online, the cloud version inside Microsoft 365, is patched by Microsoft and was not the target of these on-prem exploits. Migrating off self-hosted SharePoint is the durable way to remove this class of risk.
How fast do I need to patch SharePoint Server?
Immediately, ideally within hours. These are actively exploited zero-days on CISA's Known Exploited Vulnerabilities list, which means attackers are using them now. The 2026 Verizon DBIR found 31% of breaches begin with an unpatched vulnerability, so patch latency is a direct predictor of compromise.
If I already patched, am I safe?
Not necessarily. In the SharePoint attack chain, an attacker who reached your server before the patch may have stolen the ASP.NET machine keys, which lets them forge trusted requests even after patching. You must also rotate the machine keys, restart IIS, and hunt for web shells and persistence. Treat any previously exposed farm as assume-breach.
How much does it cost a small business to migrate to SharePoint Online?
It varies with data volume and the number of users, but the model shifts from server hardware, Windows Server and SharePoint licenses, and monthly patch labor to a predictable per-user Microsoft 365 subscription. For most NC SMBs, migration lowers both risk and total cost of ownership. Preferred Data can scope a fixed-price migration after a short discovery.
What if we have a legacy line-of-business system tied to on-prem SharePoint?
Some manufacturers and specialty firms have integrations that assume an on-prem farm. In those cases, harden and isolate the server now (patch, rotate keys, remove internet exposure, add MDR) while planning a phased migration or re-platforming of the integration. Do not leave the farm internet-reachable while you wait.
Does Preferred Data provide 24/7 monitoring for servers like this?
Yes. Our managed cybersecurity and managed IT services include 24/7 monitoring and managed detection and response, patch management, and backup verification, wired specifically to catch the web-shell and privilege-escalation activity seen in the SharePoint attack chain.
Related Resources
- Microsoft July 2026 Patch Tuesday SharePoint fixes - Field Effect
- CVE-2026-56164 technical analysis - Penligent
- 2026 Verizon DBIR: SMBs bearing the brunt of ransomware - Infosecurity Magazine
- Preferred Data Cybersecurity Services
- Preferred Data Managed IT Services
- Preferred Data Cloud Solutions
- Preferred Data Backup and Data Protection