CVE-2026-55040: microsoft sharepoint_server

CVSS 9.1 (critical) · listed as exploited by CISA since 2026-08-18 · published 2026-07-14

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

Affected products (NVD): microsoft sharepoint_server

Fixed in (NVD): 16.0.19725.20434

Weakness: CWE-1390

Source: NVD CVE-2026-55040

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040
• https://github.com/sfewer-r7/CVE-2026-55040
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55040
• https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.