LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
cve recordcriticalexploited in the wild3 of 3 cataloguesexploit reported

CVE-2026-55040

Microsoft · SharePoint · Microsoft SharePoint Weak Authentication Vulnerability

Published · Added to CISA KEV
CVSS9.1
Severitycritical
WeaknessCWE-1390
EPSS69.5%99.4th percentile
Exploited3 KEV sources
Ransomware useUnknown
Federal fix dueAug 21, 2026

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

patch window

Called exploited 29 days after disclosure.

Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.

The life of this vulnerability

  1. CVE published
  2. First KEV listing29d
  3. Last KEV listing6d
  4. Last sighting7d

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

Sources3 of 3
Listings differ by6 d
Strongest claimconfirmed

3 catalogues list it. CIRCL aggregates the others and is shown but not counted.

Public exploitation evidence

6 public reports collected from VulnCheck and CIRCL, first on Aug 12, 2026. Each links to its original source. We have not verified them.

Description

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

← Back to the CVE Tracker

Our coverage of CVE-2026-55040

CVE-2026-63520critical

Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

A remote code execution (RCE) vulnerability, identified as CVE-2026-63520, has been disclosed in Microsoft SharePoint, allowing an authenticated attacker to execute arbitrary code on a vulnerable server. When chained with an authentication bypass vulnerability, CVE-2026-55040, the exploit becomes unauthenticated.

CVE-2026-58231high

Crooks Buy Expired Domains for Malware Delivery, Other Threats Detailed

Cybercriminals are increasingly acquiring expired internet domains to host malware and execute other malicious activities, according to recent security reports. This tactic leverages previously legitimate domain names, which can lend an air of trustworthiness to their operations.

CVE-2026-55040critical

Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040)

Attackers are actively exploiting a critical vulnerability in Microsoft SharePoint, tracked as CVE-2026-55040, following the public release of proof-of-concept (PoC) exploit code. The flaw, which allows for authentication bypass and impersonation, was addressed by Microsoft in its July 2026 Patch Tuesday updates.

CVE-2026-55040critical

SharePoint CVE-2026-55040 Comes Under Attack Following Public Exploit

Attackers have begun exploiting a critical authentication bypass vulnerability in Microsoft SharePoint, designated CVE-2026-55040, following the public release of a proof-of-concept (PoC) exploit. The flaw, which carries a CVSS score of 9.1, allows unauthenticated attackers to impersonate any SharePoint user, including administrators.

CVE-2026-55040critical

Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

Threat actors are actively exploiting a critical Microsoft SharePoint vulnerability, identified as CVE-2026-55040, according to recent reports. This exploitation campaign began shortly after a proof-of-concept (PoC) exploit for the flaw was publicly released. The vulnerability is described as a security feature bypass, enabling unauthenticated attackers to impersonate legitimate users within…