Skip to content

CVE · Exploited · On CISA KEV

CVE-2026-55040

Microsoft SharePoint Weak Authentication Vulnerability

9.1
CVSS 3.1
1
story
AUG 18
added to KEV
Severity
9.1 Critical · vendor score
Vendor
Microsoft
Product
SharePoint
Published
Jul 14, 2026
Added to KEV
Aug 18, 2026
KEV deadline
Aug 21, 2026
Ransomware use
Unknown
Weakness
CWE-1390

What it is

Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. VulnerabilitiesUnauthenticated RCE Chain Found For Microsoft SharePoint CVE-2026-55040 and CVE-2026-63520The chain leverages two distinct vulnerabilities—an authentication bypass and an unsafe .NET type instantiation flaw—to provide full server control without valid credentials.DENNIS FISHER · 2 MIN

Official references

5 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Fixmsrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040Exploitgithub.com/sfewer-r7/CVE-2026-55040