[HIGH PRIORITY] Microsoft SharePoint Authentication Bypass (CVE-2026-55040)

⚠ HIGH PRIORITY — CISA KEV (Aug 2026). CVE-2026-55040 is a weak-authentication flaw in Microsoft SharePoint Server. Remote attackers bypass security features and authentication over the network — enabling unauthorized access to sites, document libraries, and potentially code execution via malicious web parts.

Affected SharePoint

• SharePoint Server subscription editions listed in Microsoft security guide
• On-premises SharePoint exposed on ports 443/80
• Hybrid deployments with on-prem SharePoint still serving content

Verify build

Get-SPFarm | Select BuildVersion
(Get-SPServer).Version
curl -sk https://sharepoint.corp/_layouts/15/viewlsts.aspx | head -5

Patching Method

1. Download SharePoint security update from Microsoft Update Catalog.
2. Run Microsoft SharePoint Products Configuration Wizard after patch install.
3. Apply patch to all WFE and app servers in the farm — same maintenance window.
4. Verify farm version in Central Administration → Upgrade Status.
5. Review IIS and ULS logs for anomalous authentication from external IPs.
6. Reset farm service account passwords if exploitation suspected.
7. Enable SharePoint audit logging for site collection admin changes.

Get-SPProduct -All | Where-Object {$_.Patchable -eq $true}
Merge-SPLogFile -Path C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\LOGS

Until patched

• Restrict SharePoint to VPN or internal network only
• Enable WAF rules blocking known SharePoint exploit paths
• Disable anonymous access and unused site collections

CVSS: 9.1 Critical. Federal remediation deadline: 21 Aug 2026.