CVE-2026-55040
Microsoft SharePoint Server Security Feature Bypass Vulnerability
Exploited in the wild. In CISA KEV since 2026‑08‑18. A vendor fix is available.
What to do
The vendor has published a fix. Version details are below where the sources state them.
Steps
Written by AI from the record- Check which Microsoft SharePoint Server product you run (2016, 2019, or Subscription Edition) and confirm the currently installed patch level.
- If you are on an affected version, upgrade SharePoint to the fixed versions listed below.
- After updating, verify your SharePoint patch level matches the fixed version for your edition and review relevant access/activity logs for unusual requests.
What it is
From the CVE record
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
In plain language
Written by AI from the recordCVE-2026-55040 is a SharePoint Server security bypass that lets an attacker access (and possibly change) protected information over the network without logging in; if you run SharePoint Server 2016/2019/Subscription Edition, you should treat this as urgent and update to the fixed versions.
CVE-2026-55040 is a security feature bypass in Microsoft SharePoint Server (Enterprise 2016, Server 2019, and Subscription Edition) that can be reached over the network without authentication, allowing an attacker to obtain sensitive data and potentially modify information due to weak authentication.
If you're affected
- Unauthorized access to sensitive files
- Customer or business data exposure
- Content tampering in SharePoint
- Disruption from incident response
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Listed as exploited in the wild since 2026-08-18.
US federal agencies must remediate by 2026-08-21.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
18% chance of exploitation activity in the next 30 days, which ranks it in the 97th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
- Attention now
Rising.
Lifecycle
28 events over 72 days, from the signal feeds we watch.
- EPSS band changehigh → moderateepss band change
- EPSS band changemoderate → high
- EPSS band changemoderate → highepss band change
- EPSS band changelow → moderate
- EPSS band change0 → moderateepss band change
- Nuclei check added
Affected products
- sharepoint serverEnterprise Software / collaboration-groupware
- Microsoft SharePoint Enterprise Server 2016Enterprise Software / itsm-monitoring
- Microsoft SharePoint Server 2019Enterprise Software / itsm-monitoring
- Microsoft SharePoint Server Subscription EditionEnterprise Software / collaboration-groupware
Technical detail
CVSS 3.1 vector
Open in the CVSS calculatorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Scored 9.1 by NVD.
How it is reached
- Attack Vector NetworkExploitable remotely over the network without any special conditions
- Attack Complexity LowNo special conditions — the attack can be reliably reproduced
- Privileges Required NoneNo authentication required — anyone can exploit this
- User Interaction NoneNo user interaction needed — fully automated exploitation
Scope
- Scope UnchangedImpact is limited to the vulnerable component itself
Impact if exploited
- Confidentiality HighTotal information disclosure — all data in the component is compromised
- Integrity HighTotal loss of integrity — attacker can modify any data in the component
- Availability NoneNo availability impact
Weaknesses
Sources
References in the record
- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040
- github.com/sfewer-r7/CVE-2026-55040
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55040
And 1 more reference. See all after sign-in
In the news
All news- SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE
- September 2026 Patch Tuesday forecast: All we need is more time
- ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories
- Hackers target Microsoft SharePoint RCE chain with PoC exploit
- Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
- CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities
- Week in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-day
- Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040)
- Microsoft выпустила патчи более чем для 400 уязвимостей
- Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Sharepoint Server, not every advisory. This one: actively exploited.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI