Intel

CVE-2026-55040

Microsoft SharePoint — Microsoft SharePoint Weak Authentication Vulnerability

criticalKEV: actively exploitedPoCEPSS 40%

Description

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

Source: BSIBSI_CSAFCISA_KEVNVDCVEORGCVELISTV5MSRC

Response & Mitigation

Why act now?

Prioritisation rationale

With a CVSS v3 score of 9.1 (AV:N/AC:L/PR:N/UI:N) and an EPSS percentile of 98.5 %, this vulnerability sits in the extreme tail of exploitation likelihood — meaning automated or opportunistic exploitation attempts are highly probable in the near term. The bypass allows an unauthenticated network attacker to circumvent authentication controls and gain access to confidential documents, SharePoint sites, and potentially stored credentials (C:H, I:H), making it particularly dangerous for NIS2-regulated organisations where SharePoint often underpins critical business processes and sensitive data flows. Although CISA has not flagged known ransomware campaign use at this time, the combination of zero-prerequisite network exploitability and near-top-percentile EPSS score justifies treating this as a P1 incident: patch within 24 hours or activate all compensating controls immediately and schedule the patch for the next available maintenance window.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch: Update Microsoft SharePoint Server to a build beyond 16.0.19725.20434. The specific KB article and download link are listed in the Microsoft Security Response Center (MSRC) advisory for CVE-2026-55040 — verify the exact KB ID there before deploying.
  • Audit and harden authentication methods: Identify all SharePoint web applications using weak authentication (NTLM, Basic Auth, Forms-Based Authentication without MFA) and migrate to Kerberos or Modern Authentication (OAuth 2.0 / OIDC) as an emergency measure.
  • Restrict external access: Limit inbound traffic to SharePoint endpoints (TCP 443, TCP 80) from untrusted networks via WAF or perimeter firewall to known IP ranges or VPN egress points until the patch is validated in production.
  • Rotate privileged credentials: Immediately reset passwords for all SharePoint service accounts and farm administrator accounts; update corresponding entries in Azure AD / Active Directory.
  • Ensure centralised logging: Confirm that SharePoint ULS and Windows Security Event Logging are active on all SharePoint servers and that logs are forwarded to your SIEM with a minimum 90-day retention period (NIS2 obligation).

Runbook · Step 2

Mitigation layers

  • Network segmentation: Place SharePoint servers in a dedicated VLAN; restrict east-west traffic to required ports only (TCP 1433 for SQL, TCP 445 for SMB to defined hosts). No direct internet egress from SharePoint servers.
  • WAF rule: Deploy a WAF signature detecting anomalous authentication requests — specifically requests lacking valid session tokens or carrying manipulated Authorization headers targeting /_layouts/, /_vti_bin/, and /sites/ paths. Snort/Suricata rule sketch: alert http any any -> $SHAREPOINT_SERVERS 443 (msg:"CVE-2026-55040 Auth Bypass Attempt"; content:"/_layouts/"; http_uri; content:"Authorization|3a|"; http_header; pcre:"/Authorization:\s*(Basic|NTLM)\s+[A-Za-z0-9+\/=]{0,20}(?!\S)/Hi"; sid:2026550401; rev:1;)
  • Enable IPS block mode: Activate SharePoint authentication-attack signatures in your IPS (e.g. Palo Alto Threat Prevention, Cisco Firepower) and set them to block rather than alert.
  • Least-privilege application pool identities: Reduce IIS application pool identities to minimum required AD permissions; ensure farm admin rights are held only by dedicated admin accounts, not service accounts.
  • Enforce MFA via Conditional Access: Configure Azure AD Conditional Access (or ADFS claims rules) to require MFA for all SharePoint access, including internal users. Document and minimise any exceptions.
  • Disable unused web service endpoints: Disable /_vti_bin/ (SOAP/legacy web services) if not operationally required — these endpoints are a common attack surface for authentication bypass techniques.

Runbook · Step 3

Detection rules

  • Windows Security Event Log: Monitor for Event ID 4625 (logon failure) and 4648 (logon with explicit credentials) on SharePoint servers; a spike of 4625 events with Logon Type 3 (network) in a short window is a strong indicator.
    • KQL: SecurityEvent | where EventID in (4625, 4648) and Computer has "sharepoint" | summarize count() by Account, IpAddress, bin(TimeGenerated, 5m) | where count_ > 20
  • IIS access logs / SharePoint ULS: Flag HTTP 200 responses to /_layouts/15/, /_vti_bin/, or /sites/ paths that are not preceded by a standard 401/302 authentication challenge-response flow.
    • SPL: index=iis sourcetype=iis cs-uri-stem="*/_layouts/*" sc-status=200 | where NOT match(cs(Authorization), "Bearer\s+[A-Za-z0-9\-_\.]+\.[A-Za-z0-9\-_\.]+\.[A-Za-z0-9\-_\.]+")
  • Sysmon EID 1 / process ancestry: Alert on unexpected child processes spawned by w3wp.exe — direct children such as cmd.exe, powershell.exe, or wscript.exe indicate post-exploitation activity.
    • Sigma shape: title: Suspicious Child Process of IIS Worker | logsource: {product: windows, category: process_creation} | detection: selection: {ParentImage|endswith: '\w3wp.exe', Image|endswith: ['\cmd.exe','\powershell.exe','\wscript.exe']} | condition: selection
  • Network telemetry (Zeek/Suricata): Correlate connections to SharePoint servers from external IPs with very short TLS session durations (< 2 s) combined with HTTP 200 responses to POST requests on authentication endpoints — consistent with automated exploit tooling.
  • Azure AD sign-in logs (hybrid deployments): Escalate sign-ins where clientAppUsed = "Other clients" or authenticationRequirement = "singleFactorAuthentication" is observed against SharePoint resources without an MFA claim.

Metrics

Severity
critical
Priority score
234.61
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
9.1
Source: nvd-v3
CVSS v3
9.1
CVSS v4
—
EPSS percentile
98.5 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
39.6 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2026-08-18 00:00 UTC
CWE
CWE-1390

Weakness classes (CWE)

  • CWE-1390Class

    Weak Authentication

    The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-08-19 04:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-55040","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technic… → {"id":"CVE-2026-55040","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technic…

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • microsoft

    sharepoint_server16.0.19725.20434

  • microsoft

    sharepoint_server

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked advisories

IDCVE-2026-55040