CVE-2026-55040 CRITICAL

CVE-2026-55040: Microsoft SharePoint Server Security Feature Bypass Vulnerability

Vendor Microsoft
Product Microsoft SharePoint Enterprise Server 2016
Weakness CWE-1390
KEV Status Known Exploited
Published July 14, 2026
Last update September 2, 2026
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C

What the vulnerability does

01Description

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

CISA mandated remediation

02CISA Required Action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Key dates

03Disclosure timeline

July 14, 2026 CVE published
September 2, 2026 Record updated

External resources

04References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-55040 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1390.html AskarLabs — CWE-1390 write-up Weak Authentication CISA KEV Reference https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026… CISA KEV Reference https://www.cisa.gov/news-events/directives/bod-26-04-prioriti… CISA KEV Reference https://www.cisa.gov/news-events/directives/bod-26-04-implemen… CISA KEV Reference https://nvd.nist.gov/vuln/detail/CVE-2026-55040

Related vulnerabilities

05Related CVE

CVE-2025-47479 WordPress WP Compress plugin <= 6.30.30 - Broken Authentication Vulnerability CVE-2023-41862 WordPress VS Contact Form plugin <= 14.0 - Sum Captcha Bypass vulnerability CVE-2025-39596 WordPress Quentn WP plugin <= 1.2.8 - Privilege Escalation Vulnerability CVE-2024-13239 Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003 CVE-2026-57352 WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.0 - Broken Authentication vulnerability