Cyber Resilience

CVE-2026-55040

Microsoft Sharepoint Server ≤ 16.0.19725.20434

Published
14 July 2026
Modified
15 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 9.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.013 69th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-55040 is a critical-severity Weak Authentication (CWE-1390) vulnerability in Microsoft Sharepoint Server. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A07:2025 Authentication Failures

EU & UK References

Vulnerability Data

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

CWE(s)
CWE-1390

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Weak authentication bypass in network-accessible SharePoint service directly enables exploitation of public-facing applications for unauthorized access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2023-33159Same product: Microsoft Sharepoint Server
CVE-2023-36764Same product: Microsoft Sharepoint Server
CVE-2024-43503Same product: Microsoft Sharepoint Server
CVE-2023-36892Same product: Microsoft Sharepoint Server
CVE-2023-33157Same product: Microsoft Sharepoint Server
CVE-2024-30043Same product: Microsoft Sharepoint Server
CVE-2023-36891Same product: Microsoft Sharepoint Server
CVE-2023-36890Same product: Microsoft Sharepoint Server
CVE-2024-32987Same product: Microsoft Sharepoint Server
CVE-2024-30044Same product: Microsoft Sharepoint Server

Affected Assets

microsoft
sharepoint server
2016, 2019 · ≤ 16.0.19725.20434

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • IA-2 Identification and Authentication (Organizational Users)
  • AC-3 Access Enforcement
  • IA-5 Authenticator Management
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 9 hardening rules · 7 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V7.6.1
  • V6.3.6
  • V6.4.2
  • V6.4.4

Mitigating Controls (NIST 800-53 r5) AI

IA-2 Identification and Authentication (Organizational Users) good match
prevent

Directly requires identification and authentication of users before granting access, blocking the weak-auth bypass described in the CVE.

AC-3 Access Enforcement good match
prevent

Enforces access-control policies that would reject the unauthorized network requests exploiting the authentication weakness.

IA-5 Authenticator Management partial match
prevent

Mandates proper authenticator management and strength, directly mitigating the weak authentication mechanism in SharePoint.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 full match
prevents

Explicitly requires authentication of users/services/hardware with MFA and password-strength controls.

PR.AA-02 mostly match
prevents

Identity proofing and binding is a core prerequisite for non-weak authentication.

PR.AA-01 partial match
prevents

Credential management directly supports stronger authentication but does not guarantee proof of identity.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.5 Secure authentication full match
prevents

Mandating multi-factor and non-password authentication techniques counters the use of inherently weak single-factor or password-only authentication mechanisms.

A.5.17 Authentication information partial match
prevents

Strong-password and non-reuse requirements raise the bar against weak single-factor authentication that can be exploited via guessing or credential stuffing.

Hardening callouts derived

Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).

Ubuntu 22.04 (1 rule)
  • V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. via CWE-1390

References