{"id":"CVE-2026-55040","title":"Microsoft SharePoint Server Security Feature Bypass Vulnerability","summary":"Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C","cvssSource":"cna","cwe":["CWE-1390"],"vendor":"Microsoft","product":"Microsoft SharePoint Enterprise Server 2016","affected":["sharepoint_enterprise_server_2016 >= 16.0.0 < 16.0.5561.1001","sharepoint_server_2019 >= 16.0.0 < 16.0.10417.20175","sharepoint_server_subscription_edition >= 16.0.0 < 16.0.19725.20434"],"ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total","timestamp":"2026-07-13T00:00:00+00:00"},"exploited":true,"exploitAvailable":true,"published":"2026-07-14","updated":"2026-09-17","sourceUpdated":"2026-09-17T22:32:59.741Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-55040","references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040","label":"Microsoft SharePoint Server Security Feature Bypass Vulnerability"}],"tags":["cve.org","in-the-wild","exploit-available","kev"],"epss":0.50585,"epssPercentile":0.98896,"kev":true,"kevDateAdded":"2026-08-18","kevDueDate":"2026-08-21","kevRansomware":false,"exploits":{"github":5,"githubRepos":["https://github.com/sfewer-r7/CVE-2026-55040","https://github.com/l0ggg/CVE-2026-55040","https://github.com/zenzue/CVE-2026-55040"],"nuclei":["javascript/cves/2026/CVE-2026-55040"],"checkedAt":"2026-09-21T15:29:33.426Z"},"ingestedAt":"2026-09-08T17:06:31.908Z","slug":"CVE-2026-55040","body":"## Overview\n\nWeak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.\n\n## Affected\n\n- `sharepoint_enterprise_server_2016 >= 16.0.0 < 16.0.5561.1001`\n- `sharepoint_server_2019 >= 16.0.0 < 16.0.10417.20175`\n- `sharepoint_server_subscription_edition >= 16.0.0 < 16.0.19725.20434`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"hadal","depthScore":85,"depthScoreParts":{"impact":50.1,"likelihood":10.1,"exploitation":25,"ransomware":0},"changes":[{"seq":201773,"id":"CVE-2026-55040","ts":1789399704351,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":200503,"id":"CVE-2026-55040","ts":1789397361202,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":198420,"id":"CVE-2026-55040","ts":1789391949618,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":196213,"id":"CVE-2026-55040","ts":1789383563719,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":195142,"id":"CVE-2026-55040","ts":1789380461797,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":193929,"id":"CVE-2026-55040","ts":1789378482326,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":192716,"id":"CVE-2026-55040","ts":1789376393899,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":191503,"id":"CVE-2026-55040","ts":1789373384725,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":190288,"id":"CVE-2026-55040","ts":1789369281473,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":189075,"id":"CVE-2026-55040","ts":1789368251429,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":187858,"id":"CVE-2026-55040","ts":1789365138161,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":186645,"id":"CVE-2026-55040","ts":1789363237981,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":185431,"id":"CVE-2026-55040","ts":1789361086570,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":184218,"id":"CVE-2026-55040","ts":1789358121805,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":182469,"id":"CVE-2026-55040","ts":1789354211589,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":181262,"id":"CVE-2026-55040","ts":1789353105365,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":180055,"id":"CVE-2026-55040","ts":1789350156596,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":178848,"id":"CVE-2026-55040","ts":1789348069100,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":177641,"id":"CVE-2026-55040","ts":1789346267779,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":176434,"id":"CVE-2026-55040","ts":1789342989945,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":174551,"id":"CVE-2026-55040","ts":1789334755609,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":173346,"id":"CVE-2026-55040","ts":1789333466692,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":172160,"id":"CVE-2026-55040","ts":1789330990213,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":170974,"id":"CVE-2026-55040","ts":1789328591076,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":169769,"id":"CVE-2026-55040","ts":1789327042326,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":168564,"id":"CVE-2026-55040","ts":1789323646347,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":167359,"id":"CVE-2026-55040","ts":1789319480543,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":166154,"id":"CVE-2026-55040","ts":1789318533001,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":164949,"id":"CVE-2026-55040","ts":1789315693188,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":163744,"id":"CVE-2026-55040","ts":1789313438725,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":162539,"id":"CVE-2026-55040","ts":1789311807024,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":161334,"id":"CVE-2026-55040","ts":1789308512301,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":160839,"id":"CVE-2026-55040","ts":1789304442301,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":160386,"id":"CVE-2026-55040","ts":1789303969191,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":159447,"id":"CVE-2026-55040","ts":1789300397322,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":158677,"id":"CVE-2026-55040","ts":1789299470013,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":157641,"id":"CVE-2026-55040","ts":1789296576399,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":156436,"id":"CVE-2026-55040","ts":1789294568256,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":155231,"id":"CVE-2026-55040","ts":1789292782131,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":154026,"id":"CVE-2026-55040","ts":1789289574026,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":152676,"id":"CVE-2026-55040","ts":1789281474317,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":152316,"id":"CVE-2026-55040","ts":1789281071515,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":151277,"id":"CVE-2026-55040","ts":1789277530478,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":150238,"id":"CVE-2026-55040","ts":1789276055456,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":149205,"id":"CVE-2026-55040","ts":1789273727312,"field":"epss","old":"0.39652","new":"0.50585"},{"seq":148172,"id":"CVE-2026-55040","ts":1789271094987,"field":"epss","old":"0.50585","new":"0.39652"},{"seq":146207,"id":"CVE-2026-55040","ts":1789269269265,"field":"epss","old":"0.39652","new":"0.50585"}]}