If your organization runs Microsoft SharePoint Server on-premises, this is one update you shouldn't postpone.
On July 14, 2026, Microsoft released one of the largest Patch Tuesday updates in its history, addressing 622 security vulnerabilities, including 416 Windows-related flaws.
Among those fixes was CVE-2026-55040, a critical authentication bypass vulnerability affecting multiple supported versions of Microsoft SharePoint Server.
While the flaw alone is serious, researchers warn that it becomes significantly more dangerous when combined with another vulnerability in a multi-stage attack chain.
Here's what CVE-2026-55040 does, which SharePoint servers are affected, and how administrators can protect their environments.
What Is CVE-2026-55040?
CVE-2026-55040 is a critical authentication bypass vulnerability affecting on premises Microsoft SharePoint Server installations.
The vulnerability was discovered and responsibly disclosed by Stephen Fewer, Senior Principal Security Researcher at Rapid7.
Authentication bypass vulnerabilities allow attackers to access protected functionality without successfully completing the normal login process.
In practical terms, an attacker may be able to interact with a vulnerable SharePoint server without possessing valid credentials.
This significantly lowers the barrier for additional attacks.
Why Is This Vulnerability So Dangerous?
Authentication bypass vulnerabilities are often used as the first stage of larger attacks.
According to Rapid7's disclosure, CVE-2026-55040 can serve as the initial step in a broader exploit chain.
Once authentication protections are bypassed, attackers may combine the flaw with another vulnerability to obtain Remote Code Execution (RCE).
Remote Code Execution is one of the most severe vulnerability classes because it can potentially allow attackers to:
- Execute malicious code remotely
- Install malware
- Deploy ransomware
- Steal sensitive documents
- Create administrator accounts
- Move laterally across enterprise networks
Microsoft addressed the authentication bypass during the July Patch Tuesday release, helping organizations eliminate the first stage of this potential attack chain.
Understanding the Multi-Step Attack Chain
Many modern cyberattacks don't rely on a single vulnerability.
Instead, attackers combine multiple weaknesses together.
A typical attack chain might look like this:
- Bypass authentication.
- Gain access to protected services.
- Exploit another vulnerability.
- Execute arbitrary code.
- Establish persistence.
- Exfiltrate data.
Breaking any link in the chain prevents the entire attack from succeeding.
By installing Microsoft's July security update, administrators remove the authentication bypass that enables the initial compromise.
Which SharePoint Versions Are Affected?
The vulnerability affects on-premises SharePoint Server deployments.
Microsoft released security updates for:
- SharePoint Server Subscription Edition
- SharePoint Server 2019
- SharePoint Server 2016
Organizations using SharePoint Online through Microsoft 365 are not required to install server updates themselves because Microsoft's cloud infrastructure receives security patches automatically.
How to Patch Your SharePoint Servers
Microsoft recommends applying the July 2026 security updates as soon as possible.
Follow these steps:
Step 1: Verify Your SharePoint Version
Determine the exact version and build number running across your SharePoint farm.
This ensures you download the correct security update.
Step 2: Download the Security Update
Visit:
- Microsoft Update Catalog
- Microsoft Security Update Guide
Locate the July 2026 Security Update corresponding to your SharePoint version.
Step 3: Install the Update
Apply the update to every SharePoint server in your environment, including:
- Front-end web servers
- Application servers
- Search servers
- Distributed Cache servers
- Any additional farm members
Keeping versions consistent across the farm helps avoid compatibility issues.
Step 4: Run PSConfig
This is one of the most commonly overlooked steps.
Installing the update package alone does not complete the SharePoint upgrade.
After installation:
- Launch the SharePoint Products Configuration Wizard (PSConfig).
- Run it on every server in the SharePoint farm.
- Allow database schema updates to complete.
- Restart services if prompted.
Only after PSConfig finishes successfully is the security update fully applied.
Why Attackers May Move Quickly
Once Microsoft publishes security updates, attackers often analyze the patches to determine what changed.
This process commonly known as patch diffing helps researchers understand vulnerabilities that have been fixed.
Unfortunately, malicious actors can use the same technique to identify systems that remain unpatched.
Organizations that delay installing security updates may therefore become easier targets after public disclosure.
Best Practices for SharePoint Administrators
Beyond installing the July update, administrators should also:
- Enable multi-factor authentication for administrator accounts.
- Restrict internet exposure of SharePoint servers whenever possible.
- Regularly review SharePoint logs for unusual authentication attempts.
- Keep Windows Server fully updated.
- Monitor Microsoft's Security Update Guide for future advisories.
- Maintain tested backups before applying cumulative updates.
Layered security significantly reduces the likelihood of a successful compromise.
Frequently Asked Questions
What is CVE-2026-55040?
It is a critical authentication bypass vulnerability affecting on-premises Microsoft SharePoint Server deployments.
Is SharePoint Online affected?
Microsoft has already updated SharePoint Online as part of its managed cloud infrastructure. Organizations using Microsoft 365 generally do not need to manually apply server patches.
What is an authentication bypass?
An authentication bypass allows an attacker to access protected functionality without successfully completing the normal login process.
Why is PSConfig required?
PSConfig updates SharePoint databases and completes the installation process. Without running it, the security update may not be fully applied.
Should organizations patch immediately?
Yes. Security vulnerabilities affecting enterprise collaboration platforms should be patched as soon as operationally possible after appropriate testing.
Final Thoughts
CVE-2026-55040 highlights why enterprise collaboration platforms remain attractive targets for attackers.
Authentication bypass vulnerabilities can provide the first foothold needed for much larger attacks, especially when combined with additional exploits.
Fortunately, Microsoft has already released security updates for supported SharePoint Server versions.
Organizations that promptly install the July 2026 updates and complete the required PSConfig upgrade process can significantly reduce their exposure to this critical vulnerability.
For IT administrators, this incident serves as another reminder that timely patch management remains one of the most effective cybersecurity defenses available.
Sources
- Microsoft Security Update Guide
- Microsoft Update Catalog
- Microsoft SharePoint Documentation
- Rapid7 Security Research
- Microsoft Security Response Center (MSRC)