cve recordcriticalexploited in the wild

CVE-2026-55040

Microsoft · SharePoint · Microsoft SharePoint Weak Authentication Vulnerability

Published Jul 14, 2026 · Added to CISA KEV Aug 18, 2026

CVSS9.1

Severitycritical

WeaknessCWE-1390

ExploitedYes, in CISA KEV

Ransomware useUnknown

Federal fix dueAug 21, 2026

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

← Back to the CVE Tracker

Our coverage of CVE-2026-55040

CVE-2026-63520Aug 24, 2026critical

Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

Rapid7 has published a technical analysis of CVE-2026-63520, a critical remote code execution vulnerability in Microsoft SharePoint. The vulnerability allows an authenticated attacker to execute arbitrary code on a vulnerable server by uploading a malicious BDC model file. When combined with another vulnerability, CVE-2026-55040, it can lead to unauthenticated RCE.

CVE-2026-58231Aug 16, 2026high

Crooks Buy Expired Domains for Malware Delivery, Other Threats Detailed

Cybercriminals are exploiting expired domain names to distribute malware, a tactic highlighted in a recent security newsletter. The newsletter also covers a range of other threats including zero-day exploits in macOS and GeoServer, a data leak affecting Chess.com users, and attacks targeting Adobe Commerce and SharePoint.

CVE-2026-55040Aug 13, 2026critical

Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040)

Threat actors have begun exploiting a critical Microsoft SharePoint flaw following the release of proof-of-concept (PoC) exploit code by Rapid7. About CVE-2026-55040 Tracked as CVE-2026-55040, the vulnerability was patched by Microsoft as part of its July 2026 Patch Tuesday updates. “The authentication feature could be bypassed as this vulnerability allows impersonation,” Microsoft said. “Exploiti

CVE-2026-55040Aug 13, 2026critical

SharePoint CVE-2026-55040 Comes Under Attack Following Public Exploit

Attackers are actively exploiting a critical SharePoint vulnerability, CVE-2026-55040, following the public release of a proof-of-concept exploit. This flaw allows unauthenticated attackers to impersonate any user, including administrators, by forging JWT tokens. While Microsoft patched the vulnerability in July, organizations that have not yet applied the update remain at risk of unauthorized access and data manipulation.

CVE-2026-55040Aug 13, 2026critical

Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

Threat actors are actively exploiting a critical Microsoft SharePoint vulnerability, CVE-2026-55040, following the public release of a proof-of-concept (PoC) exploit. This security feature bypass allows unauthenticated attackers to impersonate users and potentially modify data by exploiting weaknesses in JWT token validation. Microsoft had previously patched this flaw in its July 2026 updates.