Vulnerability intelligence

CVE-2026-55040

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

CVSS Score

9.1

Critical

EPSS — Exploit Probability

5.5%

Riskier than 92% of all CVEs

Exploitation

Confirmed in the wild

KEV since 2026-08-18

Remediation

Patch available

Federal deadline 2026-08-21

NVD entry Vendor patch PoC / advisory CISA KEV

15 articles across 6 outlets · first covered Jul 15, 2026 · latest Aug 25, 2026

Coverage timeline

Critical SharePoint RCE and Auth Bypass Flaws Actively Exploited
securityonline.info · Aug 25, 2026
Telegram seeks .gram domain as critical zero day exploits surge
securityonline.info · Aug 19, 2026
Urgent Patches Address Flaws in Microsoft, Apple, IBM Db2
securityonline.info · Aug 19, 2026
Google patches Android ContactsProvider2 SQLi high severity bug
securityonline.info · Aug 19, 2026
CISA warns of active exploits in Microsoft, VMware, Apple bugs
www.securityweek.com · Aug 19, 2026
U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog
securityaffairs.com · Aug 19, 2026
CISA Urges Patching of Microsoft SharePoint Flaw CVE-2026-55040
www.cisa.gov · Aug 19, 2026
CISA flags critical SharePoint auth bypass CVE-2026-55040 in KEV
cisa.gov · Aug 18, 2026
SharePoint Zero Day Flaw Exploited After Rapid7 PoC Release
securityaffairs.com · Aug 13, 2026
SharePoint Auth Bypass Flaw CVE-2026-55040 Under Active Attack
www.securityweek.com · Aug 12, 2026
Critical SharePoint JWT flaw lets attackers bypass authentication
securityonline.info · Aug 12, 2026
CVE-2026-55040: SharePoint flaw lets attackers forge admin tokens
www.rapid7.com · Aug 11, 2026
Rapid7 Finds Critical SharePoint RCE Flaw Tied to Auth Bypass
www.rapid7.com · Aug 11, 2026
CISA urges swift patching of SharePoint after zero day exploits
www.securityweek.com · Jul 15, 2026
Patch Tuesday - July 2026
www.rapid7.com · Jul 15, 2026