The Cybersecurity and Infrastructure Security Agency (CISA) has recently added a serious vulnerability in Microsoft SharePoint to its Known Exploited Vulnerabilities (KEV) catalog. This decision follows the active exploitation of the flaw identified as CVE-2026-55040. The agency is urging organizations to swiftly secure their on-premises environments to mitigate potential risks.
Understanding the Vulnerability
CVE-2026-55040 represents a significant flaw in the authentication process of Microsoft SharePoint. This vulnerability allows attackers to bypass security measures without authenticating themselves, posing a severe threat to internet-facing deployments. The issue is linked to CWE-1390, which highlights weaknesses in authentication mechanisms. Exploitation can occur without requiring valid SharePoint credentials, making it easier for attackers to target vulnerable systems.
The vulnerability specifically impacts the JSON Web Token validation path in SharePoint. By exploiting this flaw, attackers can forge authentication tokens that SharePoint mistakenly validates as legitimate. This can lead to unauthorized access to sensitive areas, including user impersonation, administrative roles, and confidential documents, all without obtaining passwords or session cookies.
Affected Systems and Immediate Actions
The vulnerability affects on-premises versions of SharePoint Server, including the Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. It is important to note that SharePoint Online remains unaffected by this issue. Microsoft responded by releasing fixes as part of its July 2026 security updates. Despite these updates, organizations that have delayed applying patches are now at increased risk of exploitation.
CISA included this vulnerability in its KEV catalog on August 18, 2026, and set a remediation deadline for August 21, 2026. Although the agency did not specifically mention ransomware, its inclusion in the KEV list underscores the urgency for incident response and patch management.
Recommended Security Measures
Organizations must prioritize applying Microsoft’s security updates and mitigations, especially for externally accessible SharePoint servers. Administrators should ensure that updates are fully deployed across all servers in a SharePoint farm and complete any necessary post-installation configurations. Incomplete patching may still leave systems vulnerable.
Security teams are advised to meticulously review SharePoint and identity logs for any indications of suspicious activities, such as attempted token forgery or unauthorized administrative access. Key indicators include unexpected authentication events, unusual admin logins, and abnormal access patterns to sensitive sites.
With CISA’s guidance, stakeholders are encouraged to follow vendor instructions, adhere to Binding Operational Directive 26-04 for risk-based patching, and assess the internet exposure of their assets. If effective mitigations are unavailable, organizations may need to consider removing the vulnerable product from service to safeguard their systems.
By taking these proactive measures, organizations can strengthen their security posture against potential threats associated with this critical SharePoint vulnerability.
