CVE-2026-55040Vulnerability
Microsoft SharePoint Weak Authentication Vulnerability
Reported by 6 independent sources · first reported by Rapid7 · last reported
Last reported 22 days ago
Fix due 21 Aug 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
6 reports, newest first · the exact sentence from each-
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks“…ts arsenal may also include recent flaws such as CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522, and CVE-2026-55040.”
-
Microsoft security advisory – August 2026 monthly rollup (AV26-804) – Update 4“On August 18, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-33824 and CVE-2026-55040 to their Known Exploited Vulnerabilities (KEV) Database.”
-
SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE“The researcher has since disclosed several other SharePoint flaws, including CVE-2026-55040, an authentication bypass that attackers exploited shortly after its details became public in August.”
-
August 2026 CVE Landscape“CVE-2026-55040”
-
Risky Bulletin: Russia starts blocking DoH and DoT“One of them, CVE-2026-55040, has already been reported as exploited in the wild last week after POC code was published online.”
-
Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)“When combined with the authentication bypass, CVE-2026-55040, the resulting exploit chain is unauthenticated RCE against a vulnerable SharePoint server.”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-33824, CVE-2026-21962, CVE-2026-65660, CVE-2026-63520, CVE-2025-49113, CVE-2026-68820, CVE-2026-65400, CVE-2026-60004, CVE-2026-64849, CVE-2026-0300, CVE-2026-32201, CVE-2026-33017, CVE-2017-0199, CVE-2022-0847, CVE-2026-50522, CVE-2026-58644, CVE-2026-34486, CVE-2026-39987, CVE-2026-56164, CVE-2026-63030
Thanks — we review every report.