VulnerabilityBleeping Computer
9.1 — CRITICAL
Hackers leverage new Microsoft SharePoint exploit in attacks
Hackers have already begun using a proof-of-concept (PoC) exploit for a critical Microsoft SharePoint vulnerability, published by cybersecurity company Rapid7 on Tuesday. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
Hackers are leveraging a newly discovered Microsoft SharePoint vulnerability (CVE-2026-55040) in attacks, exploiting an authentication bypass security flaw that allows attackers to perform operations as a site user or administrator without privileges.
⚙️Technical Details
💥Impact Assessment
Severity: Critical
Who Is at Risk
Network defenders and organizations using Microsoft SharePoint servers exposed online
🛡️Recommended Actions
1Secure SharePoint servers against potential CVE-2026-55040 attacks by patching systems running SharePoint Enterprise Server 2016 and SharePoint Server 2019.
2Block external access to SharePoint Central Administration and restrict farm and database communication to required systems.
3Place servers behind a Layer 7 reverse proxy or similar application-layer security control where Internet exposure is required.
📦Affected Products
Microsoft Sharepoint Server
🔐NVD Verified DataVERIFIED
CVE-2026-55040 ↗CVSS 9.1 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NWeaknesses
CWE-1390
Affected Products (CPE)
Microsoft Sharepoint Server
CVE-2026-45659 ↗CVSS 8.8 — HIGH
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-502
Affected Products (CPE)
Microsoft Sharepoint Server
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.