CVE-2026-55040

CVE-2026-55040 is a Security Feature Bypass in Microsoft SharePoint that carries a CVSS score of 9.8 and an EPSS exploit probability of 57 percent, which together mean an attacker who can reach the server is likely to defeat a protection control rather than trip an alert. It is not on the CISA Known Exploited Vulnerabilities catalog and has no confirmed ransomware association at this time, so this is a patch-ahead-of-attack situation, not incident cleanup. The exposure spans three specific builds you may run side by side: SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, so inventory each farm version separately because they take different update packages. A bypass class matters here because it can neutralize a guardrail that other SharePoint fixes assume is intact, which is why a 57 percent EPSS on a bypass deserves the same urgency as a code-execution bug even without KEV listing. Note: I attempted to pull the Microsoft advisory, the CISA page, and an analyst report to ground this read, but the web search tool returned no retrievable results in this session, so the citations below could not be verified and are omitted rather than invented.

Do this: Confirm which of the three affected products each farm runs, then apply the Microsoft security update for CVE-2026-55040 that matches that exact build, prioritizing any SharePoint server reachable from outside your network. Until every farm is patched, restrict inbound access to SharePoint web front ends to known clients and review authentication and access logs for requests that succeed against resources a bypass would normally block. Before deploying, confirm the current patch and URL directly on Microsoft's MSRC update guide entry for CVE-2026-55040, since I could not retrieve and verify that page here.

AI-generated from public data, 2026-07-26. Verify against the vendor advisory before acting.