Bottom line: A critical SharePoint authentication bypass vulnerability (CVE-2026-55040, CVSS 9.1) is being actively exploited following the publication of a PoC, and unpatched systems should be updated immediately.
Following the release of publicly available proof-of-concept code, a critical Microsoft SharePoint vulnerability is being actively exploited by attackers. The flaw allows an authentication bypass with a CVSS score of 9.1.
The vulnerability in question is CVE-2026-55040, with a CVSS score of 9.1. It describes a critical “Security Feature Bypass” in Microsoft SharePoint stemming from a weak authentication implementation. Microsoft addressed the flaw as part of the July 2026 Patch Tuesday updates.
Following the release of a proof-of-concept exploit, threat actors have begun actively exploiting the vulnerability. This places CVE-2026-55040 among a series of SharePoint vulnerabilities that have repeatedly been used in the past as entry points for attacks on enterprise networks, since SharePoint servers often manage central document and identity data.
For CISOs, this creates an immediate need for action: systems that have not yet had the July 2026 update applied are considered exposed once working PoC code is freely available. The combination of a high CVSS score, authentication bypass, and publicly accessible exploit code significantly increases the likelihood of automated mass scanning and opportunistic attacks.
Those responsible should check whether affected SharePoint instances have already been patched and prioritize completing the patch process if this has not yet occurred. It is also advisable to review access logs for unusual authentication attempts or anomalies related to SharePoint endpoints in order to detect any prior compromises at an early stage.
Source: thehackernews.com · Published August 13, 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.