Vulnerability Details CVE-2026-55040
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.397
EPSS Ranking 98.6%
CVSS Severity
CVSS v3 Score 9.1
Proposed Action
Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.
Ransomware Campaign
Unknown
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040
- https://github.com/sfewer-r7/CVE-2026-55040
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55040
- https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/
Products affected by CVE-2026-55040
-
cpe:2.3:a:microsoft:sharepoint_server:-
-
cpe:2.3:a:microsoft:sharepoint_server:16.0.10417.20003
-
cpe:2.3:a:microsoft:sharepoint_server:16.0.17328.20246
-
cpe:2.3:a:microsoft:sharepoint_server:16.0.17328.20292
-
cpe:2.3:a:microsoft:sharepoint_server:16.0.17328.20362
-
cpe:2.3:a:microsoft:sharepoint_server:16.0.17928.20356
-
cpe:2.3:a:microsoft:sharepoint_server:16.0.17928.20396
-
cpe:2.3:a:microsoft:sharepoint_server:16.0.18526.20172
-
cpe:2.3:a:microsoft:sharepoint_server:16.0.18526.20286
-
cpe:2.3:a:microsoft:sharepoint_server:16.0.18526.20396
-
cpe:2.3:a:microsoft:sharepoint_server:16.0.18526.20424
-
cpe:2.3:a:microsoft:sharepoint_server:16.0.18526.20508
-
cpe:2.3:a:microsoft:sharepoint_server:16.0.18526.20518
-
cpe:2.3:a:microsoft:sharepoint_server:16.0.19127.20100
-
cpe:2.3:a:microsoft:sharepoint_server:16.0.19127.20262
-
cpe:2.3:a:microsoft:sharepoint_server:16.0.19127.20338
-
cpe:2.3:a:microsoft:sharepoint_server:16.0.19127.20378
-
cpe:2.3:a:microsoft:sharepoint_server:16.0.19127.20442
-
cpe:2.3:a:microsoft:sharepoint_server:2016
-
cpe:2.3:a:microsoft:sharepoint_server:2019