CVE-2026-55040CriticalCISA KEV · due 21 Aug

Microsoft SharePoint Server Security Feature Bypass Vulnerability

Listed in the CISA Known Exploited Vulnerabilities catalog

Added 18 Aug 2026 · federal remediation due 21 Aug 2026.

Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.

Assessment

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

Severity: Critical
CVSS base score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
Impact: Security Feature Bypass
EPSS, next 30 days: 18%Higher than 97% of scored CVEs · FIRST model run 26 Sep 2026 · about EPSS
Exploitability: Exploitation More Likely
Publicly disclosed: No
Customer action: Required: apply the update
Component: Microsoft Office SharePoint
Weakness: CWE-1390: Weak Authentication
Issued by: Microsoft
Published: 14 Jul 2026 · July 2026
Last revised: 14 Jul 2026

3 KBs

KB	Type	Restart	Applies to	Other CVEs
KB5002882	Security Update	—	Microsoft SharePoint Server Subscription Edition	All CVEs in KB5002882
KB5002883	Security Update	—	Microsoft SharePoint Server 2019	All CVEs in KB5002883
KB5002891	Security Update	—	Microsoft SharePoint Enterprise Server 2016	All CVEs in KB5002891

Microsoft Office

3 affected products