Microsoft SharePoint Weak Authentication Vulnerability (CVE-2026-55040)

6 karet z 8 položek · v celém archivu · celý přehled CZ · EN/orig

CVE-2026-55040

KEV ✓ EPSS 0.70 EPSS k 18. 10. 2026 náprava do 21. 8. 2026

Hodnocení závažnosti

9.1 CVSS 3.1 microsoft

útok odkudkoli z internetu bez přípravy bez přihlášení bez zásahu uživatele

dopad plný únik dat úplná změna dat bez výpadku

přesah dopad jen na zranitelnou součást

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C

zvyšuje závažnost mírně zvyšuje závažnost snižuje závažnost

cve.org · NVD

Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu. Fakta o samotném CVE jsou nahoře.

26. 8. 2026 16:47

Hackers target Microsoft SharePoint RCE chain with PoC exploit

Attackers are now targeting a chain of two Microsoft SharePoint vulnerabilities that can allow them to execute arbitrary code on unpatched servers, according to threat intelligence company Defused. [...]

CVE-2026-32201 * CVE-2026-45659 * CVE-2026-55040 * CVE-2026-56164 * CVE-2026-63520 * Microsoft US

26. 8. 2026 16:47 · BleepingComputer · Hackers target Microsoft SharePoint RCE chain with PoC exploit

18. 8. 2026 19:53

Microsoft security advisory – August 2026 monthly rollup (AV26-804) – Update 1

Serial Number: AV26-804Date: August 11, 2026Updated: August 18, 2026 As of August 11, 2026, Microsoft is affected by vulnerabilities in the following products: .NET 10.0 installed on Linux .NET 10.0 installed on Mac OS .NET 10.0 installed on Windows .NET 8.0 installed on Linux .NET 8.0 installed on Mac OS .NET 8.0 installed on Windows .NET 9.0 installed on Linux .NET 9.0 installed on Mac OS .NET 9.0 installed on Windows App Installer Application Insights Profiler Azure Active Directory Azure…

KEV ✓ EPSS 0.70 CVE-2026-33824 CVE-2026-55040 Microsoft CA

18. 8. 2026 19:53 · Cyber Centre Kanada · Microsoft security advisory – August 2026 monthly rollup (AV26-804) – Update 1

18. 8. 2026 · zachyceno 20:30

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability CVE-2026-55040 Microsoft SharePoint Weak Authentication Vulnerability CVE-2026-59310 Broadcom VMware vCenter Path Traversal Vulnerability CVE-2026-65400 Apple macOS Improper Authentication Vulnerability These types of vulnerabilities are a frequent attack vector…

KEV ✓ · ransomware EPSS 0.70 CVE-2026-33824 CVE-2026-55040 CVE-2026-59310 CVE-2026-65400 Microsoft Broadcom Apple veřejná správa US

18. 8. 2026 · zachyceno 20:30 · CISA Advisories · CISA Adds Four Known Exploited Vulnerabilities to Catalog

18. 8. 2026 · zachyceno 19:00

SPOJENO PŘES CVE Microsoft SharePoint Weak Authentication Vulnerability (CVE-2026-55040)

CISA added CVE-2026-55040 to the Known Exploited Vulnerabilities catalog. Affected product: Microsoft SharePoint. Remediation due date: 2026-08-21.

KEV ✓ EPSS 0.70 CVE-2026-55040 Microsoft US

18. 8. 2026 · zachyceno 19:00 · CISA KEV · Microsoft SharePoint Weak Authentication Vulnerability (CVE-2026-55040) 11. 8. 2026 15:00 · Rapid7 · Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040) 14. 7. 2026 · Microsoft Security · CVE-2026-55040 Microsoft SharePoint Server Security Feature Bypass Vulnerability

11. 8. 2026 23:10

Patch Tuesday - August 2026

Microsoft is publishing 421 vulnerabilities on August 2026 Patch Tuesday, including 236 vulnerabilities in Windows. This is lower volume than last month’s record-breaking behemoth, but still one of the largest Patch Tuesday totals ever. There is no reason to suppose that Patch Tuesday will ever return to the lower volumes we saw prior to 2026. Microsoft is aware of exploitation in the wild for one of the vulnerabilities published today, as well as public disclosure for two others, although the…

KEV ✓ EPSS 0.70 CVSS 5.5 CVE-2026-50656 CVE-2026-55040 CVE-2026-62832 CVE-2026-63520 CVE-2026-6726 CVE-2026-6727 CVE-2026-68820 CVE-2026-72971 Microsoft US

11. 8. 2026 23:10 · Rapid7 · Patch Tuesday - August 2026

11. 8. 2026 15:00

CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)

OverviewRapid7 Labs conducted a zero-day research project against Microsoft SharePoint, resulting in the discovery of two new vulnerabilities that, when chained together, achieve unauthenticated remote code execution (RCE) against a vulnerable SharePoint server. Today, both Rapid7 and Microsoft are disclosing the second vulnerability in this chain, the RCE vulnerability CVE-2026-63520. The first vulnerability in the chain, CVE-2026-55040, was disclosed by Rapid7 and Microsoft last month.Our…

KEV ✓ EPSS 0.70 CVSS 8.1 CVE-2026-55040 CVE-2026-63520 Microsoft veřejná správa finance US

11. 8. 2026 15:00 · Rapid7 · CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)