CVE-2026-55040

Microsoft SharePoint Server Security Feature Bypass Vulnerability

Exploited in the wild. In CISA KEV since 2026‑08‑18. Fixed versions are out.

CVSS 3.19.1Critical EPSS percentile99th70% chance in 30 days CISA KEVListedsince 2026-08-18, due 2026-08-21
No public exploit known Fix4 products3 fixed builds listed below

Published 2026-07-14Updated 2026-08-19Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Microsoft SharePoint Enterprise Server 2016Affected: ≥ 16.0.0, < 16.0.5561.1001Upgrade to: 16.0.5561.1001Stated by: CVE record
Microsoft SharePoint Server 2019Affected: ≥ 16.0.0, < 16.0.10417.20175Upgrade to: 16.0.10417.20175Stated by: CVE record
Microsoft SharePoint Server Subscription EditionAffected: ≥ 16.0.0, < 16.0.19725.20434Upgrade to: 16.0.19725.20434Stated by: CVE record
Microsoft Sharepoint ServerAffected: < 16.0.19725.20434Upgrade to: 16.0.19725.20434Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which Microsoft SharePoint Server product you run (2016, 2019, or Subscription Edition) and confirm the currently installed patch level.
If you are on an affected version, upgrade SharePoint to the fixed versions listed below.
After updating, verify your SharePoint patch level matches the fixed version for your edition and review relevant access/activity logs for unusual requests.

Usually a quick update

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

Coverage timeline

5 publishers

Threat actors began actively exploiting CVE-2026-55040 in Microsoft SharePoint following the release of a public proof-of-concept by Rapid7, allowing unauthenticated attackers to bypass authentication and impersonate users.
as reported · Oct 2, 2026·SecurityWeek summary
Rapid7 publishes technical analysis and PoC for SharePoint authentication bypass CVE-2026-55040 affecting JWT validation.
as reported · Sep 22, 2026·The Hacker News summary
Advisory coverage
as reported · Aug 19, 2026·SecurityWeek summary
Added to CISA KEV catalog
Aug 18, 2026·CISA KEV
Vendor patch released
as reported · Aug 11, 2026·The Hacker News summary
Rapid7 researchers discovered a JWT token authentication bypass (CVE-2026-55040) in Microsoft SharePoint, enabling unauthenticated RCE when chained with another vulnerability.
as reported · Jul 13, 2026·Rapid7 Blog summary

Sourced from public security reporting — each date is when it was published, not when it happened. 15 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

In plain language

Written by AI from the record

CVE-2026-55040 is a SharePoint Server security bypass that lets an attacker access (and possibly change) protected information over the network without logging in; if you run SharePoint Server 2016/2019/Subscription Edition, you should treat this as urgent and update to the fixed versions.

CVE-2026-55040 is a security feature bypass in Microsoft SharePoint Server (Enterprise 2016, Server 2019, and Subscription Edition) that can be reached over the network without authentication, allowing an attacker to obtain sensitive data and potentially modify information due to weak authentication.

If you're affected

Unauthorized access to sensitive files
Customer or business data exposure
Content tampering in SharePoint
Disruption from incident response

What is it

Think of SharePoint like your company’s filing room with a lock. This vulnerability is a flaw in the way that “lock” checks who is allowed in, letting an attacker slip past without needing a login. Once inside, they may be able to view confidential information and possibly change content.

Who is affected

This matters if your business runs Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition. The concern is higher because the issue is reachable over the network and does not require an attacker to log in. It is primarily a risk when SharePoint is exposed to attackers through network access (for example, accessible from the internet or any reachable network segment).

How urgent is it

This is RED because a network-accessible security bypass with no authentication can directly lead to unauthorized data access and possible modification. Even though there’s no confirmed, dated exploitation in the provided reporting and no public exploit code noted, the vulnerability is considered an attractive target and new, so you should act now to close the hole.

What to do — in detail

Confirm exposure

Identify your SharePoint edition:
- Microsoft SharePoint Enterprise Server 2016
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server Subscription Edition
Determine your current installed build/patch level for SharePoint.
Compare your installed version against the fixed versions:
- SharePoint Enterprise Server 2016 is fixed in 16.0.5561.1001
- SharePoint Server 2019 is fixed in 16.0.10417.20175
- SharePoint Server Subscription Edition is fixed in 16.0.19725.20434

Remediate

Plan an immediate SharePoint update to the fixed version matching your edition.
Apply the update during an approved maintenance window, following your usual SharePoint change control process.
After installation, re-check the SharePoint patch/build level to confirm it matches the fixed version for your edition.

Temporary containment (if patching is delayed)

Reduce exposure by ensuring the SharePoint host is not reachable from untrusted networks.
Restrict inbound network access so that only approved users/systems can reach SharePoint.
Increase monitoring for suspicious access attempts targeting SharePoint.

What to monitor after patching

Unusual request patterns to SharePoint from unexpected source IPs.
Changes to sensitive documents, permissions, or content within SharePoint.
Any access attempts that occur without valid authentication.

KEV / deadlines

This CVE is not listed in the CISA KEV list based on the provided findings, so no KEV-specific due date was given.

Technical context

CVE-2026-55040 (CWE-1390) is a security feature bypass caused by weak authentication in Microsoft SharePoint Server. The findings indicate network-based reachability without authentication and no user interaction required, which means an attacker can trigger the flaw remotely and attempt to access protected resources. Business-impact potential includes unauthorized access to sensitive data and potential modification of information.

Exploitation status in the provided findings: not listed in CISA KEV; no clear dated real-world exploitation claim provided; no public exploit code on record. Despite this, CISA guidance described in the findings indicates it is an attractive target.

Fixed versions (per patch findings):

SharePoint Enterprise Server 2016: 16.0.5561.1001
SharePoint Server 2019: 16.0.10417.20175
SharePoint Server Subscription Edition: 16.0.19725.20434

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Listed as exploited in the wild since 2026-08-18.

US federal agencies must remediate by 2026-08-21.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

70% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

31 events over 83 days, from the signal feeds we watch.

2026-10-05EPSS band changemoderate → highepss band change
2026-09-30EPSS band changehigh → moderate
2026-09-24EPSS band changehigh → moderateepss band change
2026-09-14EPSS band changemoderate → high
2026-09-12EPSS band changemoderate → highepss band change
2026-08-31EPSS band changelow → moderate

Affected products

Microsoftcommercial · US
- sharepoint serverWeb AppOn-premEnterprise Software / collaboration-groupware
- Microsoft SharePoint Enterprise Server 2016Web AppOn-premEnterprise Software / itsm-monitoring
- Microsoft SharePoint Server 2019Web AppOn-premEnterprise Software / itsm-monitoring
- Microsoft SharePoint Server Subscription EditionWeb AppOn-premEnterprise Software / collaboration-groupware

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Scored 9.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability NoneNo availability impact