CISA added CVE-2026-55040, a critical (CVSS 9.1) weak authentication flaw in Microsoft Office SharePoint, to its Known Exploited Vulnerabilities catalog on 2026-08-18 with a three-day remediation deadline.
What Is It
CVE-2026-55040 is a weak authentication vulnerability (CWE-1390) in Microsoft Office SharePoint that allows an unauthorized attacker to bypass a security feature over a network. Microsoft published the CVE on 2026-07-14 and assigned a CVSS 3.1 base score of 9.1 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, network-reachable, low complexity, no privileges, no user interaction, with high confidentiality and integrity impact.
Why It Matters
CISA's SSVC assessment scores this as exploitation: active, automatable: yes, technicalImpact: total. Active exploitation is confirmed by the vulnerability's inclusion in the KEV catalog (added 2026-08-18). Known ransomware campaign use is listed as Unknown. Public exploit material is referenced in the NVD record, including a Rapid7 write-up on JWT token authentication bypass and an associated GitHub repository; meaning attack details are in the open.
What's Vulnerable
Per Microsoft's affected-product data, all on x64-based systems:
| Product | Fixed in |
|---|---|
| SharePoint Enterprise Server 2016 | 16.0.5561.1001 |
| SharePoint Server 2019 | 16.0.10417.20175 |
| SharePoint Server Subscription Edition | 16.0.19725.20434 |
Versions from 16.0.0 up to (but not including) each build above are affected.
Patch Status
Microsoft's MSRC update guide is the vendor advisory and patch source. CISA's required action: apply mitigations in accordance with vendor instructions, ensuring compliance with BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and CISA's "Forensics Triage Requirements." Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and adhering to BOD 26-04 patching guidelines. Due date: 2026-08-21.
Sources
- Microsoft MSRC Update Guide; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040
- NVD, CVE-2026-55040, https://nvd.nist.gov/vuln/detail/CVE-2026-55040
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55040
- CISA BOD 26-04; https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements; https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- Rapid7, Microsoft SharePoint JWT Token Authentication Bypass, https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/
- Proof-of-concept repository; https://github.com/sfewer-r7/CVE-2026-55040