On August 18, 2026, CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including a critical Microsoft SharePoint Server authentication bypass (CVE-2026-55040) that lets attackers impersonate users without a password. If your business runs on-premises SharePoint Server, this is a patch-and-verify moment this week — not a wait-and-see one.
Quick answer: CISA confirmed that attackers are actively exploiting a critical flaw in on-premises Microsoft SharePoint Server (CVE-2026-55040, patched by Microsoft on July 14) that lets an unauthenticated attacker bypass login and act as any user, including administrators. If your organization runs SharePoint Server on-premises, confirm the July 2026 security updates are installed on every server and that no SharePoint server is exposed directly to the internet.
What happened?
On August 18, 2026, CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, all confirmed as actively exploited in the wild. The KEV catalog is CISA’s list of flaws with real evidence of attackers using them — not theoretical risks. When a vulnerability lands on this list, the message is straightforward: patch it, then check whether someone already got in.
The four vulnerabilities span Apple macOS, Microsoft SharePoint, VMware vCenter, and Windows. The two most relevant to small and mid-size businesses are:
-
CVE-2026-55040 — Microsoft SharePoint Server Weak Authentication Vulnerability. Microsoft patched this on July 14, 2026, and CISA added it to the KEV catalog on August 18 with a federal remediation deadline of August 21. It carries a CVSS severity score of 9.1 out of 10 (Critical). An unauthenticated attacker on the network can bypass SharePoint’s authentication and impersonate any user whose identity they can enumerate — including a site administrator. Microsoft’s advisory confirms it affects SharePoint Server 2016, 2019, and Subscription Edition. Security firm Rapid7, which discovered the flaw, published a proof-of-concept on August 11, and CISA’s listing followed a week later based on evidence of active exploitation.
-
CVE-2026-65400 — Apple macOS Improper Authentication Vulnerability. Apple patched this on August 6, 2026 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. The flaw is in macOS Screen Sharing: an attacker on the network can authenticate without valid credentials. The Netherlands National Cyber Security Centre confirmed active exploitation, reporting that attackers gained root access on compromised Macs and installed cryptocurrency miners. Ars Technica reported that the highest-risk systems are Macs with Screen Sharing’s port 5900 reachable from the internet.
This SharePoint vulnerability is part of a broader pattern CISA has been tracking all summer. On July 14, 2026, CISA issued a separate alert urging organizations to harden on-premises SharePoint Server after active exploitation of six related vulnerabilities. CISA updated that alert on August 18 to reflect the KEV addition and again on August 26 to clarify guidance on avoiding direct internet exposure of SharePoint servers. The alert notes that attackers are using these vulnerabilities for remote code execution and post-exploitation activities including stealing server credentials and deploying malware.
Why does this matter for small businesses?
A common assumption in small organizations is that targeted attacks only happen to large enterprises. CISA’s KEV catalog challenges that — these vulnerabilities are being exploited against whatever systems are reachable, and on-premises SharePoint servers are common in small and mid-size businesses that set up their own infrastructure rather than migrating fully to Microsoft 365.
Three reasons this matters for a 5-to-150-employee business:
On-premises SharePoint is more common than you might think. Many small businesses and nonprofits in Pennsylvania still run SharePoint Server 2016 or 2019 on a single on-premises server, often set up years ago and maintained inconsistently since. If your organization hosts its own SharePoint rather than using SharePoint Online through Microsoft 365, this vulnerability applies to you.
The patch has been available since July 14, but exploitation was confirmed by August 18. That’s roughly a five-week window. If your SharePoint server wasn’t patched in July, it’s been exposed to active exploitation since at least August 11, when Rapid7 published proof-of-concept code. CISA’s guidance isn’t just “patch now” — it’s “patch, then check whether you were already compromised.”
Small businesses are less likely to have the monitoring to detect a breach. CISA’s SharePoint hardening alert recommends reviewing logs for anomalous authentication requests, suspicious worker-process activity, and webshells. Most small organizations don’t have someone actively reviewing SharePoint server logs. A compromise could go undetected for weeks or months — which is exactly the scenario that turns a patchable vulnerability into a data-loss event.
The macOS Screen Sharing vulnerability in the same CISA batch is worth noting too, especially for professional offices, creative agencies, and nonprofits where Macs are common. The fix is simpler — install the August 6 macOS update and make sure Screen Sharing isn’t exposed to the internet — but it’s the same lesson: a patch was available, and exploitation followed within days.
What should you do this week?
If your organization runs on-premises SharePoint Server, here’s a practical checklist for this week:
-
Confirm which version of SharePoint you’re running. If you’re not sure, ask your IT provider or whoever manages your Microsoft environment. SharePoint Online (Microsoft 365) is not affected. On-premises SharePoint Server 2016, 2019, or Subscription Edition is.
-
Verify the July 2026 security updates are installed. Microsoft released the patch for CVE-2026-55040 on July 14, 2026. If your server hasn’t been patched since then, that’s the first priority. The relevant updates are KB 5002882 (Subscription Edition), KB 5002883 (SharePoint Server 2019), and KB 5002891 (SharePoint Enterprise Server 2016).
-
Check whether your SharePoint server is exposed to the internet. CISA’s August 26 guidance is explicit: avoid exposing SharePoint Servers directly to the internet. If your server is reachable from outside your office network — through a port forward, a public IP, or a VPN-less remote access setup — that’s the highest-risk configuration. CISA recommends placing it behind a reverse proxy that enforces authentication, or removing external access entirely.
-
Review for signs of prior exploitation. If your server was unpatched between July 14 and now, CISA recommends checking SharePoint ULS logs and IIS logs for anomalous bearer-token authentication, unexpected administrative activity, and access from unfamiliar IP addresses. This is the step most small businesses can’t do alone — it’s where a managed IT partner adds the most value.
-
Patch your Macs too. If your team runs macOS, confirm every Mac is updated to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9 (the versions that patch CVE-2026-65400). Check that Screen Sharing is off when not in use, and that port 5900 is not exposed to the internet.
If you’re not sure whether you run on-premises SharePoint, or you know you do but aren’t confident about the patch status, that’s the most common situation for a small business — and it’s exactly what a free technology assessment is designed to clarify. We can tell you what you’re running, what’s patched, and what isn’t, without a contract or a sales pitch.
Frequently asked questions
Does this SharePoint vulnerability affect SharePoint Online (Microsoft 365)? No. CVE-2026-55040 affects only on-premises SharePoint Server — SharePoint Server 2016, 2019, and Subscription Edition. If your organization uses SharePoint Online through a Microsoft 365 subscription, this specific vulnerability does not apply to you. SharePoint Online is patched by Microsoft on the cloud side, with no action required from your team.
How do I know if we’re running on-premises SharePoint Server? If your team accesses SharePoint through a URL on your own company domain (not sharepoint.com), and your IT provider or an internal server hosts it, you’re likely running on-premises SharePoint Server. If you access it through the Microsoft 365 portal or a *.sharepoint.com address, you’re on SharePoint Online and this vulnerability doesn’t affect you. When in doubt, ask whoever manages your Microsoft environment to confirm.
What does “actively exploited” actually mean? It means CISA has confirmed that attackers are already using this vulnerability to break into real systems — not that it’s a theoretical risk. CISA’s Known Exploited Vulnerabilities catalog only includes flaws with evidence of in-the-wild exploitation. That’s why the federal remediation deadline was set to just three days after the August 18 listing.
We patched in July. Do we need to do anything else? If you’ve confirmed the July 2026 Microsoft security updates were successfully installed on every SharePoint server in your environment, you’re protected against CVE-2026-55040 itself. However, CISA’s broader SharePoint alert covers six vulnerabilities exploited this summer, so it’s worth confirming your environment is current on all Microsoft security updates — not just this one CVE. Also verify that no SharePoint server is exposed directly to the internet.
Should a small business without on-premises SharePoint still pay attention to this alert? Yes, for two reasons. First, the same CISA batch included a macOS Screen Sharing vulnerability (CVE-2026-65400) that Apple patched on August 6 — if your office runs Macs, that update matters. Second, the pattern — a known flaw being exploited within days of a patch being available — is a reminder that keeping all software current, not just SharePoint, is the single most effective security practice for a small business.
Where Merit IT fits in
This is the kind of situation where having a managed IT partner who monitors advisories and acts on them matters. At Merit IT, we track CISA’s Known Exploited Vulnerabilities catalog as part of our IT support practice — when a flaw like this lands, we identify which of our clients are affected, confirm patches are applied, and check for signs of prior exploitation. It’s part of keeping the lights on, not a separate emergency engagement.
If your organization doesn’t have someone doing that — whether you have no IT team, one person wearing too many hats, or a vendor who isn’t proactive about security advisories — that’s worth addressing before the next alert, not during it. We work with small businesses and nonprofits across Pennsylvania on a month-to-month basis, with no long-term contract. We earn your business every single month, or we don’t.
Get a free technology assessment — we’ll review your current environment, including your SharePoint and patch status, and give you a clear picture of where you stand. No obligation, no pressure. Or keep reading on the Merit IT blog for more practical, no-hype IT guidance.