CVE-2026-55040: Microsoft SharePoint weak authentication allows network security feature bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 9.1 unauthenticated network bypass, active KEV listing with a near-term remediation deadline, public exploit code, and very high EPSS probability.

What it is

Microsoft SharePoint Server contains a weak authentication flaw (CWE-1390) that lets an unauthorized attacker bypass a security feature over the network. The vulnerability is rated CVSS 9.1 critical and has been added to CISA's Known Exploited Vulnerabilities catalog, so it warrants urgent attention. The record does not specify affected SharePoint versions or the exact authentication mechanism involved.

Impact

An unauthenticated attacker can bypass authentication controls and gain high confidentiality and integrity impact on the target SharePoint instance. Availability is not affected per the CVSS vector.

Attack surface

Reachable over the network with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). Any internet- or intranet-exposed SharePoint endpoint implementing the affected authentication path is potentially in scope.

Exploitation

CISA added this to the KEV catalog on 2026-08-18 with a remediation due date of 2026-08-21, and a public exploit reference exists on GitHub. EPSS 30-day probability is 0.506 (98.9th percentile), indicating high likelihood of exploitation activity.

What to do

• Apply the Microsoft vendor patch from the MSRC update guide immediately; treat as emergency change given KEV status.
• If patching is not immediately possible, follow CISA BOD 26-04 guidance and consider discontinuing use or isolating exposed SharePoint instances.
• Restrict network access to SharePoint authentication endpoints to trusted sources and remove direct internet exposure where feasible.
• Audit and rotate any authentication secrets, tokens, or signing keys associated with the affected SharePoint authentication mechanism.
• Monitor vendor and CISA advisories for updated mitigation instructions specific to this CVE.

Detection

• Review SharePoint authentication and access logs for anomalous successful authentications from unexpected source IPs or user agents.
• Hunt for requests targeting authentication or token-issuing endpoints that bypass normal credential validation flows.
• Correlate web server logs with post-authentication activity such as unusual file access, site creation, or permission changes.
• Monitor for known exploit indicators referenced in the public GitHub proof-of-concept and Rapid7 analysis.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.