Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
CISA added four critical actively exploited flaws to KEV: macOS Screen Sharing, SharePoint, VMware vCenter, and Microsoft IKE, with APT and ransomware use.
86
CVE-2026-55040
Authentication Bypass in Microsoft SharePoint Server
CISA: Microsoft SharePoint Weak Authentication Vulnerability
- CVSS 3.1
- 9.1 critical
- EPSS
- 70%p99
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
Microsoft SharePoint Server is affected by a weak authentication vulnerability (CWE-1390) that allows an unauthorized attacker to bypass a security feature over a network. Per the CVSS vector, exploitation requires no privileges and no user interaction with low attack complexity, so any unauthenticated attacker with network access to a vulnerable server can trigger it remotely. Impact to confidentiality and integrity is rated high (CVSS 9.1, critical), meaning the bypass effectively grants the attacker access that authentication should have prevented, with no direct availability impact. All organizations running on-premises Microsoft SharePoint Server are potentially affected; the source data does not specify affected version ranges or fixed builds, so defenders should consult Microsoft's advisory for those details. The flaw is under active exploitation: a public proof-of-concept is available on GitHub, attackers began exploiting it after the PoC went public, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18 (EPSS ~40%, 99th percentile; ransomware association unknown).
What to do: Apply Microsoft's security update for CVE-2026-55040 immediately, prioritizing internet-facing SharePoint servers, and comply with CISA BOD 26-04 and the agency's Forensics Triage Requirements, including checking for signs of prior compromise on SharePoint servers. Use the public GitHub proof-of-concept to validate patching and detection coverage, and restrict network exposure of SharePoint until all servers are updated.
| Product | Affected |
|---|---|
| Microsoft SharePoint Server | — |
Estimated exposure
mass≈tens of thousands of internet-exposed SharePoint Server instances, within an installed base spanning hundreds of thousands of enterprise and government… — SharePoint Server is one of the most widely deployed on-premises collaboration platforms in enterprise and government environments, and public internet scans typically surface on the order of tens of thousands of exposed SharePoint…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
KEVCISA Known Exploited Vulnerability
- Affected
- Microsoft SharePoint
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- microsoft
- Products
- sharepoint server
- Weakness
- CWE-1390
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
In the news
19 storiesAttackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040)
Attackers use Rapid7's public PoC to exploit CVE-2026-55040, a critical SharePoint authentication bypass patched in July 2026.
84
Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)
Microsoft's August 2026 Patch Tuesday fixes 400+ vulnerabilities, including an actively exploited Windows zero-day (CVE-2026-68820) used by North Korean attackers.
82
Microsoft Patches 398 Flaws Including a Windows Driver Zero
Microsoft's August Patch Tuesday fixes 398 CVEs, including actively exploited Windows zero-day CVE-2026-68820 used by Lazarus for SYSTEM privilege escalation.
82
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks
Warlock ransomware operators continue exploiting unpatched SharePoint servers at critical infrastructure, government, and education targets.
80
U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog
CISA adds actively exploited flaws in Microsoft IKE, SharePoint, VMware vCenter, and macOS Screen Sharing to KEV catalog, due August 21.
80
CVE-2026-33824: CISA Flags Windows IKE RCE as Exploited
CISA added four actively exploited vulnerabilities to its KEV catalog, headlined by CVE-2026-33824, a Windows IKE Service Extensions remote code execution flaw.
78
Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
Attackers exploit SharePoint authentication bypass CVE-2026-55040 (CVSS 9.1) after Rapid7's PoC release, with 12 exploitation attempts recorded since July 19, 2026.
78
SharePoint CVE-2026-55040 Comes Under Attack Following Public Exploit
Attackers are actively exploiting critical SharePoint authentication bypass CVE-2026-55040 (CVSS 9.1) days after Rapid7 released a public PoC.
78
CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)
Rapid7 and Microsoft disclose CVE-2026-63520, a SharePoint RCE that chains with CVE-2026-55040 for unauthenticated RCE; patches released.
78
Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE
Rapid7 disclosed CVE-2026-55040, a SharePoint JWT validation bypass chaining into CVE-2026-63520 unauthenticated RCE, with research substantially AI-agent-assisted; patches released.
74
Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)
Rapid7's analysis of SharePoint auth bypass CVE-2026-55040 includes a PoC for unauthenticated admin-level operations.
70
SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE
Researchers show SharePoint CVE-2026-65660 enables authenticated RCE, despite Microsoft first listing it as spoofing.
68
AI-driven bug hunting fuels record Microsoft Patch Tuesday
60
Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday
60
Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities
60
Microsoft smashes Patch Tuesday record for second successive month
60
Microsoft Patches Record 622 Flaws, Including Two Zero
60
September 2026 Patch Tuesday forecast: All we need is more time
September 2026 Patch Tuesday forecast expects record CVE volume after August's 398 fixes, with SharePoint flaws CVE-2026-55040 and CVE-2026-63520 actively exploited.
45