{"id":"sharepoint-authentication-bypass-attacks-aug-2026","category":"patch","status":"closed","title":"Microsoft SharePoint authentication bypass CVE-2026-55040 exploited; fixes available","tldr":"Attackers are exploiting a SharePoint Server authentication bypass that lets them impersonate users, including administrators. July updates fixed all three affected editions. Ask your organisation’s IT team to update its servers and investigate possible intrusion.","summary":"CVE-2026-55040 is a critical authentication weakness in Microsoft SharePoint Server, affecting organisations that host their own document-sharing and collaboration servers. Rapid7 says an attacker without a login can impersonate a SharePoint user or administrator and act with that account’s permissions. Microsoft released fixes on 14 July for SharePoint Enterprise Server 2016, SharePoint Server 2019 and Subscription Edition. CISA added the flaw to its exploited-vulnerabilities catalogue on 18 August. Later that month, defenders reported attempts to combine it with a separate flaw to run code on servers; Singapore’s Cyber Security Agency subsequently warned of reported exploitation of both vulnerabilities. As of 3 November, fixes are available for all three affected editions. The reviewed sources do not establish how many organisations were compromised or whether exploitation has stopped.","action":"If your business or family office hosts SharePoint, ask its IT provider to install KB5002891 for 2016, KB5002883 for 2019 or KB5002882 for Subscription Edition, or the latest replacement update. Ask them to investigate possible unauthorised access as well. There is no update for family members to install on their phones or computers for this server flaw.","product":"Microsoft SharePoint Server","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-55040"],"tags":["microsoft","sharepoint","authentication-bypass","actively-exploited","server"],"affected":["Microsoft SharePoint Enterprise Server 2016: 16.0.0 to before 16.0.5561.1001","Microsoft SharePoint Server 2019: 16.0.0 to before 16.0.10417.20175","Microsoft SharePoint Server Subscription Edition: 16.0.0 to before 16.0.19725.20434"],"fixed":["Microsoft SharePoint Enterprise Server 2016: 16.0.5561.1001 (KB5002891)","Microsoft SharePoint Server 2019: 16.0.10417.20175 (KB5002883)","Microsoft SharePoint Server Subscription Edition: 16.0.19725.20434 (KB5002882)"],"matches":[],"sources":[{"kind":"advisory","title":"SharePoint Server Subscription Edition security update: July 14, 2026 (KB5002882)","url":"https://support.microsoft.com/en-us/servicing/office/update/2026/5002882","by":"Microsoft","date":"2026-07-14"},{"kind":"advisory","title":"SharePoint Server 2019 security update: July 14, 2026 (KB5002883)","url":"https://support.microsoft.com/en-us/servicing/office/update/2026/5002883","by":"Microsoft","date":"2026-07-14"},{"kind":"advisory","title":"SharePoint Server 2016 security update: July 14, 2026 (KB5002891)","url":"https://support.microsoft.com/en-us/servicing/office/update/2026/5002891","by":"Microsoft","date":"2026-07-14"},{"kind":"research","title":"CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)","url":"https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/","by":"Rapid7","date":"2026-07-14"},{"kind":"news","title":"Hackers target Microsoft SharePoint RCE chain with PoC exploit","url":"https://www.bleepingcomputer.com/news/security/hackers-target-microsoft-sharepoint-rce-chain-with-poc-exploit/amp/","by":"BleepingComputer","date":"2026-08-26"},{"kind":"advisory","title":"Active Exploitation of Vulnerabilities in Microsoft SharePoint","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-113/","by":"Cyber Security Agency of Singapore","date":"2026-08-28"},{"kind":"advisory","title":"CVE-2026-55040: Microsoft-authored CVE record","url":"https://opencve.alliance.unm.edu/cve/CVE-2026-55040","by":"OpenCVE","date":"2026-09-09"}],"started":"2026-08-18","closed":"2026-08-28","created":"2026-11-03T22:17:09.763Z","updated":"2026-11-03T22:17:09.763Z","cve_notes":[{"cve":"CVE-2026-55040","name":"Weak authentication in Microsoft SharePoint Server","what":"Weak authentication in Microsoft SharePoint Server allows an unauthorised attacker to bypass a security protection over a network.","severity":"critical","cvss":9.1}],"timeline":[{"at":"2026-08-28","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Singapore’s Cyber Security Agency warned that the authentication bypass and the separate code-execution vulnerability were reportedly being exploited. It urged administrators to install the latest updates.","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-113/","by":"Cyber Security Agency of Singapore","patch":null},{"at":"2026-08-25","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Defused reported attempts against its decoy servers combining the authentication bypass with a separate code-execution flaw, according to BleepingComputer. Defused said it had not observed code execution in those attempts.","url":"https://www.bleepingcomputer.com/news/security/hackers-target-microsoft-sharepoint-rce-chain-with-poc-exploit/amp/","by":"BleepingComputer","patch":null},{"at":"2026-08-18","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities catalogue after finding evidence of active exploitation, Rapid7 reported.","url":"https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/","by":"Rapid7","patch":null},{"at":"2026-07-14","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Microsoft released KB5002882 for SharePoint Server Subscription Edition, build 16.0.19725.20434, completing patch coverage across the three affected editions.","url":"https://support.microsoft.com/en-us/servicing/office/update/2026/5002882","by":"Microsoft","patch":null},{"at":"2026-07-14","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Microsoft released KB5002883 for SharePoint Server 2019, build 16.0.10417.20175, fixing the same vulnerability.","url":"https://support.microsoft.com/en-us/servicing/office/update/2026/5002883","by":"Microsoft","patch":null},{"at":"2026-07-14","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Microsoft released KB5002891 for SharePoint Enterprise Server 2016, build 16.0.5561.1001, fixing CVE-2026-55040.","url":"https://support.microsoft.com/en-us/servicing/office/update/2026/5002891","by":"Microsoft","patch":"patched"}],"url":"https://hard.fyi/live/sharepoint-authentication-bypass-attacks-aug-2026/","json":"https://hard.fyi/api/live?id=sharepoint-authentication-bypass-attacks-aug-2026"}