Microsoft SharePoint authentication bypass CVE-2026-55040 exploited; fixes available
Attackers are exploiting a SharePoint Server authentication bypass that lets them impersonate users, including administrators. July updates fixed all three affected editions. Ask your organisation’s IT team to update its servers and investigate possible intrusion.
If your business or family office hosts SharePoint, ask its IT provider to install KB5002891 for 2016, KB5002883 for 2019 or KB5002882 for Subscription Edition, or the latest replacement update. Ask them to investigate possible unauthorised access as well. There is no update for family members to install on their phones or computers for this server flaw.
What’s happening
CVE-2026-55040 is a critical authentication weakness in Microsoft SharePoint Server, affecting organisations that host their own document-sharing and collaboration servers. Rapid7 says an attacker without a login can impersonate a SharePoint user or administrator and act with that account’s permissions. Microsoft released fixes on 14 July for SharePoint Enterprise Server 2016, SharePoint Server 2019 and Subscription Edition. CISA added the flaw to its exploited-vulnerabilities catalogue on 18 August. Later that month, defenders reported attempts to combine it with a separate flaw to run code on servers; Singapore’s Cyber Security Agency subsequently warned of reported exploitation of both vulnerabilities. As of 3 November, fixes are available for all three affected editions. The reviewed sources do not establish how many organisations were compromised or whether exploitation has stopped.
- What
- Flaw
- Affects
- Microsoft SharePoint Server
- Affected
- Microsoft SharePoint Enterprise Server 2016: 16.0.0 to before 16.0.5561.1001
Microsoft SharePoint Server 2019: 16.0.0 to before 16.0.10417.20175
Microsoft SharePoint Server Subscription Edition: 16.0.0 to before 16.0.19725.20434 - Fixed in
- Microsoft SharePoint Enterprise Server 2016: 16.0.5561.1001 (KB5002891)
Microsoft SharePoint Server 2019: 16.0.10417.20175 (KB5002883)
Microsoft SharePoint Server Subscription Edition: 16.0.19725.20434 (KB5002882) - Since
- 18 Aug 2026
- Closed
- 28 Aug 2026
Timeline
- Wider attacks
Singapore’s Cyber Security Agency warned that the authentication bypass and the separate code-execution vulnerability were reportedly being exploited. It urged administrators to install the latest updates.
- Wider attacks
Defused reported attempts against its decoy servers combining the authentication bypass with a separate code-execution flaw, according to BleepingComputer. Defused said it had not observed code execution in those attempts.
- CISA added
CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities catalogue after finding evidence of active exploitation, Rapid7 reported.
- New fix
Microsoft released KB5002882 for SharePoint Server Subscription Edition, build 16.0.19725.20434, completing patch coverage across the three affected editions.
- New fix
Microsoft released KB5002883 for SharePoint Server 2019, build 16.0.10417.20175, fixing the same vulnerability.
- New fixFixed
Microsoft released KB5002891 for SharePoint Enterprise Server 2016, build 16.0.5561.1001, fixing CVE-2026-55040.
Sources
- SharePoint Server Subscription Edition security update: July 14, 2026 (KB5002882)Microsoft · 14 July 2026
- SharePoint Server 2019 security update: July 14, 2026 (KB5002883)Microsoft · 14 July 2026
- SharePoint Server 2016 security update: July 14, 2026 (KB5002891)Microsoft · 14 July 2026
- CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)Rapid7 · 14 July 2026
- Hackers target Microsoft SharePoint RCE chain with PoC exploitBleepingComputer · 26 Aug 2026
- Active Exploitation of Vulnerabilities in Microsoft SharePointCyber Security Agency of Singapore · 28 Aug 2026
- CVE-2026-55040: Microsoft-authored CVE recordOpenCVE · 9 Sept 2026