Microsoft's July 2026 Patch Tuesday addressed a record 570 vulnerabilities, but one critical flaw stands out for SharePoint administrators and developers: CVE-2026-55040. This CVSS 9.1 authentication bypass in Microsoft Office SharePoint allows unauthenticated attackers to circumvent security features over the network, potentially exposing sensitive documents and enabling data manipulation.
Vulnerability Details
CVE ID: CVE-2026-55040
CVSS 3.1 Score: 9.1 (Critical) -- Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE: CWE-1390 (Weak Authentication)
Impact: Security Feature Bypass -- Authentication bypass leading to impersonation
Exploitability: Exploitation More Likely (Microsoft assessment)
Publicly Disclosed: No
Actively Exploited: No (at time of publication)
Patch Release Date: July 14, 2026
Affected Versions
| Product | Affected Versions | Fixed Version |
|---|---|---|
| SharePoint Enterprise Server 2016 | 16.0.0 - 16.0.5561.1000 | 16.0.5561.1001+ |
| SharePoint Server 2019 | 16.0.0 - 16.0.10417.20174 | 16.0.10417.20175+ |
| SharePoint Server Subscription Edition | 16.0.0 - 16.0.19725.20433 | 16.0.19725.20434+ |
The same KB applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016.
Impact Assessment
This vulnerability resides in SharePoint's authentication mechanism. An unauthenticated, remote attacker can bypass authentication controls and establish anonymous connections to the SharePoint server. According to Microsoft's advisory:
How could an attacker exploit this vulnerability? In a network-based attack, an unauthenticated attacker could bypass authentication and make an anonymous connection.
What kind of security feature could be bypassed? The authentication feature could be bypassed as this vulnerability allows impersonation.
The CVSS vector tells the story:
- Attack Vector: Network (AV:N) -- Exploitable remotely over the network
- Attack Complexity: Low (AC:L) -- No specialized conditions required
- Privileges Required: None (PR:N) -- No authentication needed
- User Interaction: None (UI:N) -- Fully automated exploitation
- Confidentiality: High (C:H) -- Full access to restricted documents and data
- Integrity: High (I:H) -- Ability to modify or inject content
- Availability: None (A:N) -- Service remains operational
This combination means an attacker who can reach your SharePoint server over the network (including internet-facing deployments) can potentially read and modify any content the SharePoint application can access, without a single valid credential.
Affected Systems
Organizations running any of the following on-premises SharePoint deployments are affected:
- SharePoint Server 2016 (including Enterprise edition)
- SharePoint Server 2019
- SharePoint Server Subscription Edition (the latest perpetual license version)
Not affected: SharePoint Online (Microsoft 365) -- Microsoft manages patching for the cloud service automatically. If you use SharePoint in Microsoft 365, no action is required on your part.
High-Risk Scenarios
Pay particular attention if your environment includes:
- Internet-facing SharePoint sites (extranet, public websites)
- SharePoint servers in DMZ or perimeter networks
- Hybrid configurations with on-premises SharePoint connected to Microsoft 365
- Environments where SharePoint hosts sensitive intellectual property, PII, or regulated data
Mitigation & Patching
Immediate Action: Apply July 2026 Security Updates
Microsoft released fixes as part of the July 2026 Patch Tuesday. Apply the appropriate security update for your version:
- Identify your SharePoint version: Central Administration -- System Settings -- Servers in Farm -- Check "Configuration database version"
- Download the update: Visit the Microsoft Update Catalog and search for "SharePoint Server 2016/2019/SE July 2026"
- Apply the update: Run the .exe or .msi on each SharePoint server in the farm, then run the SharePoint Products Configuration Wizard
- Verify: Confirm the build number matches the fixed versions in the table above
Temporary Mitigation (If Patching Is Delayed)
If you cannot patch immediately, Microsoft recommends:
Enabling the Antimalware Scan Interface (AMSI) on the server and setting the Request Body Scan mode to Full can help mitigate this flaw.
To enable AMSI Request Body Scanning:
Additionally, consider these network-level controls:
- Restrict SharePoint access to trusted IP ranges via firewall/WAF rules
- Enforce VPN or zero-trust network access for external users
- Monitor for anomalous authentication patterns in SharePoint ULS logs
Workaround Limitations
AMSI scanning only inspects script content (PowerShell, VBScript, JavaScript). Since this vulnerability exploits a weakness in SharePoint's authentication pipeline itself -- not script execution -- AMSI provides only partial visibility. Patching remains the only complete fix.
Detection
Log Sources to Monitor
| Log Source | Event Indicators |
|---|---|
| SharePoint ULS Logs | Anonymous authentication attempts succeeding unexpectedly; SPRequest entries with empty user context accessing secured resources |
| IIS Access Logs | Requests to /_layouts/, /_api/, or /_vti_bin/ endpoints returning 200 OK without preceding 401/302 auth challenges |
| Windows Security Event Log | Event ID 4624 (Logon Type 3 - Network) with Anonymous Logon or unexpected account names |
| Network IDS/IPS | Signatures for SharePoint authentication bypass patterns (check vendor updates) |
KQL Query for Microsoft Sentinel / Defender
Quick Health Check
Run this PowerShell on each SharePoint server to verify patch status:
Frequently Asked Questions
Does this affect SharePoint Online / Microsoft 365?
No. Microsoft patches SharePoint Online automatically. Tenants are protected without customer action.
Is there public exploit code?
Not at the time of publication (July 15, 2026). Microsoft rates exploitability as "Exploitation More Likely," meaning functional exploits could emerge quickly. Patch immediately.
Which CVE is the "actively exploited" SharePoint zero-day from July Patch Tuesday?
That is CVE-2026-45659 (CVSS 8.8), a separate RCE in SharePoint Server added to CISA KEV on July 14. CVE-2026-55040 is the authentication bypass documented here -- not known to be exploited in the wild yet, but critically severe.
Can I just update one server in the farm?
No. All SharePoint servers in the farm must receive the update, followed by running the SharePoint Products Configuration Wizard on each.
Does this affect SharePoint 2013?
SharePoint 2013 reached end of support in April 2023. No security updates are provided. Migrate immediately.
What about the AD FS zero-day (CVE-2026-50304)?
Also patched in July 2026. Different component (Active Directory Federation Services), different attack vector (privilege escalation for authorized users). See Microsoft's advisory for details.
Key Takeaways
- CVE-2026-55040 is a critical authentication bypass -- unauthenticated, network-accessible, high impact on confidentiality and integrity
- Affects all on-premises SharePoint versions -- 2016, 2019, and Subscription Edition
- Patch now -- July 2026 Patch Tuesday fixes are available; exploit code will likely appear soon
- SharePoint Online is safe -- Microsoft handles cloud patching
- Monitor for anomalous access -- Check ULS and IIS logs for anonymous successes on protected endpoints
- Don't forget the other two zero-days -- CVE-2026-45659 (SharePoint RCE, actively exploited) and CVE-2026-50304 (AD FS EoP, actively exploited) also require immediate attention
Conclusion
Authentication bypass vulnerabilities in widely deployed collaboration platforms are a defender's nightmare: they turn your document repository into an open book for anyone who can reach the server. CVE-2026-55040's CVSS 9.1 rating reflects the real risk -- no credentials, no user interaction, full read/write access to SharePoint content.
If you run on-premises SharePoint, treat this as a "patch tonight" priority. The July 2026 Patch Tuesday bundle is large (570 CVEs), but this one and the two actively exploited zero-days should jump to the front of your deployment queue.
Sources:
- Microsoft Security Update Guide: CVE-2026-55040
- NVD CVE-2026-55040 Detail
- BleepingComputer: Microsoft July 2026 Patch Tuesday Fixes 570 Flaws, 3 Zero-Days
- CISA Known Exploited Vulnerabilities Catalog
Automated Transmission
This entry was synthesized and populated dynamically using native API integrations.