Microsoft: CISA Adds Microsoft SharePoint Weak Authentication Vulnerability to KEV List

Critical Microsoft SharePoint Authentication Flaw Under Active Exploitation, CISA Warns

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-55040, a severe Microsoft SharePoint authentication vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. The flaw, which affects on-premises SharePoint deployments, allows unauthenticated attackers to bypass authentication remotely by forging JSON Web Tokens (JWTs), granting them unauthorized access to sensitive data, administrative functions, and collaboration sites.

The vulnerability impacts SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, but SharePoint Online remains unaffected. Microsoft released patches in July 2026, though organizations that delayed updates now face heightened risk following the public release of proof-of-concept (PoC) exploit code. CISA added the flaw to the KEV catalog on August 18, 2026, with a remediation deadline of August 21, 2026, signaling an urgent need for action.

Exploitation does not require valid credentials, making internet-facing SharePoint servers prime targets. Attackers leveraging the flaw can impersonate legitimate users including administrators without stealing passwords or session cookies. Security teams are advised to prioritize patching externally accessible servers, verify full deployment across SharePoint farms, and monitor logs for signs of token forgery, such as unusual authentication events or unauthorized administrative access.

CISA recommends following Microsoft’s mitigation guidance, assessing internet exposure, and conducting forensic reviews if exploitation is suspected. In cases where patches cannot be applied, organizations may need to temporarily remove vulnerable systems from service to mitigate risk.

Source: https://cybersecuritynews.com/microsoft-sharepoint-authentication-vulnerability/

Microsoft TPRM report: https://www.rankiteo.com/company/microsoft

"id": "mic1787156632",
"linkid": "microsoft",
"type": "Vulnerability",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'location': 'Global',
                        'name': 'Organizations using on-premises Microsoft '
                                'SharePoint',
                        'type': 'Enterprise'}],
 'attack_vector': 'Remote Exploitation',
 'data_breach': {'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Sensitive data, administrative '
                                             'functions, collaboration sites'},
 'date_publicly_disclosed': 'July 2026',
 'description': 'The U.S. Cybersecurity and Infrastructure Security Agency '
                '(CISA) has added CVE-2026-55040, a severe Microsoft '
                'SharePoint authentication vulnerability, to its Known '
                'Exploited Vulnerabilities (KEV) catalog after confirming '
                'active exploitation in the wild. The flaw allows '
                'unauthenticated attackers to bypass authentication remotely '
                'by forging JSON Web Tokens (JWTs), granting unauthorized '
                'access to sensitive data, administrative functions, and '
                'collaboration sites.',
 'impact': {'data_compromised': 'Sensitive data, administrative functions, '
                                'collaboration sites',
            'operational_impact': 'Unauthorized administrative access, '
                                  'potential data exfiltration',
            'systems_affected': 'Microsoft SharePoint Server Subscription '
                                'Edition, SharePoint Server 2019, SharePoint '
                                'Enterprise Server 2016'},
 'post_incident_analysis': {'corrective_actions': 'Apply patches, monitor for '
                                                  'exploitation, remove '
                                                  'vulnerable systems from '
                                                  'service if necessary',
                            'root_causes': 'Unpatched Microsoft SharePoint '
                                           'vulnerability (CVE-2026-55040)'},
 'recommendations': 'Follow Microsoft’s mitigation guidance, assess internet '
                    'exposure, conduct forensic reviews if exploitation is '
                    'suspected, prioritize patching internet-facing servers',
 'references': [{'date_accessed': '2026-08-18',
                 'source': 'CISA Known Exploited Vulnerabilities (KEV) '
                           'catalog'}],
 'regulatory_compliance': {'regulatory_notifications': 'CISA KEV catalog '
                                                       'addition (August 18, '
                                                       '2026)'},
 'response': {'containment_measures': 'Prioritize patching externally '
                                      'accessible servers, verify full '
                                      'deployment across SharePoint farms, '
                                      'monitor logs for signs of token forgery',
              'enhanced_monitoring': 'Monitor logs for unusual authentication '
                                     'events or unauthorized administrative '
                                     'access',
              'remediation_measures': 'Apply Microsoft patches released in '
                                      'July 2026, remove vulnerable systems '
                                      'from service if patches cannot be '
                                      'applied'},
 'title': 'Critical Microsoft SharePoint Authentication Flaw Under Active '
          'Exploitation',
 'type': 'Authentication Bypass',
 'vulnerability_exploited': 'CVE-2026-55040'}