CVE-2026-55040KEV · OVERDUECWE-1390

Microsoft SharePoint Weak Authentication Vulnerability

Critical · published July 14, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.1. It is confirmed in active exploitation. It sits in the 99.4th percentile for exploit probability.

63
days past CISA
deadline
CVSS v3.1
9.1
EPSS
70%
Percentile
99.4
In the wild
Confirmed
What it is

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.69536 · 99.4th percentile
Weakness
CWE-1390 · Weak Authentication
Published
2026-07-14T22:18Z
KEV added
2026-08-18 · due 2026-08-21
Affected products (3)
ProductVersionsFixed in
microsoft/sharepoint_server< 16.0.19725.2043416.0.19725.20434
microsoft/sharepoint_serverall versions—
microsoft/sharepoint_serverall versions—
References (4)
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040 · [email protected]https://github.com/sfewer-r7/CVE-2026-55040 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55040 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/ · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 07 OCT 03:41Z
    EPSS moved 18% → 70%
    epss
  • 25 SEP 03:26Z
    EPSS moved 51% → 18%
    epss
  • 13 SEP 03:22Z
    EPSS moved 40% → 51%
    epss
  • 12 SEP 03:21Z
    EPSS moved 40% → 51%
    epss
  • 28 AUG 06:46Z
    EPSS moved 6% → 40%
    epss
  • 14 JUL 17:09Z
    Microsoft SharePoint Server Security Feature Bypass Vulnerability
    cvelistv5