Microsoft SharePoint CVE-2026-55040

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required beyond network reachability - remote unauthenticated exploitation against affected on-premises SharePoint servers (Enterprise Server 2016, Server 2019, Subscription Edition) with no user interaction. The primary limiting factor is deployment scope: only on-premises SharePoint server installations reachable by the attacker over the network are affected, so farms that are not internet-exposed and are segmented behind a VPN/WAF are substantially harder to reach. The exact security feature being bypassed is not named in the available data, so the precise protected asset or configuration prerequisite cannot be confirmed and should be verified against the Microsoft advisory.

The signals are largely consistent and point to genuine priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes remote, low-complexity, unauthenticated exploitation with high confidentiality and integrity impact and no availability impact, yielding a 9.1 (Critical). It is not listed in CISA KEV and no EPSS score or POC was supplied, so there is no confirmation of active exploitation or public exploit code; the risk is currently high-but-unproven-in-the-wild rather than observed. The main uncertainty is what specific 'security feature' is bypassed - the terse Microsoft description does not name it, so downstream impact (e.g., whether it enables spoofing, access to protected content, or a step toward RCE) cannot be fully characterized from the input. Given SharePoint's history as a high-value attacker target and the pre-auth network vector, this should be patched promptly even without KEV/EPSS data.

An attacker with only network access to a SharePoint front-end sends crafted requests that exploit the weak authentication logic, bypassing the intended security feature without valid credentials. Because no user interaction or privileges are needed (AV:N/AC:L/PR:N/UI:N), the attacker can then read or modify content the control was meant to protect (C:H/I:H). No public exploit is identified at time of analysis, so this scenario reflects the CVSS-described capability rather than an observed intrusion.