Our automated tracking framework flagged that CISA added CVE-2026-55040 (Microsoft SharePoint) to the Known Exploited Vulnerabilities (KEV) catalog on August 22, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-55040 by August 21, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-55040 |
| Vendor / product | Microsoft SharePoint |
| Vulnerability | Microsoft SharePoint Weak Authentication Vulnerability |
| CVSS base score | 9.1 |
| Added to KEV | August 18, 2026 |
| Days public before listing (NVD → KEV lag) | 35 |
| Federal patch deadline | August 21, 2026 |
| Known ransomware use | No |
How This Compares to Microsoft’s Track Record
This one was public for just 35 days before CISA confirmed exploitation — faster than Microsoft’s 560-day median, meaning attackers moved unusually quickly. Microsoft currently ranks #18 on our KEV Lag leaderboard.
| Microsoft in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 385 |
| Median lag (public → KEV listing) | 560 days |
| 0-day rate (exploited at or before disclosure) | 23% |
| Entries tied to known ransomware campaigns | 104 |
For perspective, the median across all 1674 tracked KEV entries is 266 days — Microsoft’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Microsoft KEV Additions
The most recent Microsoft vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-33824 | Internet Key Exchange (IKE) Service Extensions | August 18, 2026 | 126 | No |
| CVE-2026-68820 | Windows Ancillary Function Driver for WinSock | August 11, 2026 | 0 | No |
| CVE-2026-50522 | SharePoint | July 22, 2026 | 8 | No |
| CVE-2026-58644 | SharePoint | July 16, 2026 | 2 | No |
| CVE-2026-56155 | Active Directory Federation Services | July 14, 2026 | 0 | No |
What This Means for Defenders
CISA has added CVE-2026-55040, a Microsoft SharePoint vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog. With a CVSS base score of 9.1, it’s a critical risk. Federal agencies must patch by August 21, 2026, just three days after its KEV listing on August 18, 2026. All organizations, particularly those with internet-facing SharePoint or sensitive data in SharePoint, should patch immediately.
This vulnerability was public for 35 days before being added to KEV. While no ransomware use is known, active exploitation means a high likelihood of compromise. Organizations unable to patch before August 21, 2026 must restrict access to SharePoint. Implement multi-factor authentication (MFA) for all SharePoint access, and isolate SharePoint environments where possible. Network segmentation and diligent monitoring for unusual activity are also important interim measures.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- Microsoft’s CVE-2026-68820 Was Exploited in 0 Days — Well Under Its 567-Day Median (August 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
