CISA Adds Microsoft SharePoint Weak Authentication Vulnerability to KEV List
Brief
CISA added a critical Microsoft SharePoint authentication flaw to its KEV catalog after CVE-2026-55040 was confirmed in active exploitation , urging organizations to secure affected on-premises environments.
CVE-2026-55040 is a weakness in Microsoft SharePoint’s authentication handling that can allow an unauthenticated attacker to bypass a security feature remotely.
The issue is associated with CWE-1390, which covers weaknesses in authentication mechanisms. An attacker does not need legitimate SharePoint credentials to exploit the flaw, making internet-facing deployments a particularly high-risk target.
Technical reporting indicates that the vulnerability affects the JSON Web Token validation path in SharePoint. Attackers may forge authentication tokens that SharePoint accepts as valid, allowing them to impersonate site users and potentially administrators.