SharePoint on-prem CVE-2026-55040 and 65660 exploited; patch now

I saw CISA add SharePoint to the KEV list on 18 Aug. 2026, with a second entry following on 25 Sep., so I pulled the MSRC CVRF data and CISA's KEV file to compare them, because these two have similar names, their patches came out in different months, and the sources disagree on some points. A quick read can leave you confused about which patch to install.

How these two differ

CISA lists ransomware use as Unknown for both. The CVSS scores match those listed by NVD.

CVE-2026-55040 Microsoft describes the vulnerability as allowing an attacker to "impersonate another user." Rapid7, which published technical details on 11 Aug. (the page I read had a PoC screenshot but no code), says the root cause is in JWT token validation and that the attacker must know the target user's identifier beforehand (such as a SID or UPN from Active Directory). I am citing that point only from Rapid7's blog, not from Microsoft's advisory. Rapid7 also says it had chained this vulnerability with another RCE vulnerability that was still unpatched at the time. This matters because the July patch alone is not enough; see the build section below.

CVE-2026-65660 Microsoft's CVE page has a revision note dated 25 Sep. stating that, as of that date, Microsoft had reliable evidence of active exploitation of this vulnerability. The page itself says a low-privilege attacker can send a specially crafted request to the server without any user interaction.

Another point worth knowing: in the KEV file I pulled on 4 Nov. (catalogVersion 2026.11.03), 6 Microsoft SharePoint entries had been added since 1 Jul.: CVE-2026-45659 (1 Jul.), CVE-2026-56164 (14 Jul.), CVE-2026-58644 (16 Jul.), CVE-2026-50522 (22 Jul.), CVE-2026-55040 (18 Aug.), and CVE-2026-65660 (25 Sep.). The two in this article are only part of the picture. I have not checked the patches for the other four; always install a newer build.

Affected versions and fixed builds

These numbers come from MSRC's CVRF data. If the build number in your farm is below the right-hand column, it is not fully patched.

The KB5002893 page says it replaces KB5002882, and the KB5002894 page (2019) says it replaces KB5002883. I did not open the KB pages for 2016; check after installation that the build is equal to or higher than the right-hand column. Microsoft's FAQ says that when multiple packages are offered (such as the two for 2019), install all of them in any order, and the same KB applies to both SharePoint Server 2016 and Enterprise 2016.

One lifecycle point to know: Microsoft's lifecycle page says SharePoint Server 2019 reached the end of extended support in mid-Jul. 2026, and the Canadian Centre for Cyber Security's AL26-017 advisory, dated 15 Jul., says both 2016 and 2019 had reached end of life as of 14 Jul. However, the August CVRF data still includes KBs for both versions. The October CVRF data (37 SharePoint CVEs) has a new KB only for Subscription Edition: KB5002927, build 16.0.20326.20190, which is higher than the build in the table above. The entries for 2019 and 2016 still point to the July KBs (KB5002883, KB5002891). I have not checked the conditions under which these two versions receive patches. Anyone still on 2016 or 2019 should start planning a move to Subscription Edition.

How to fix it

Microsoft has not published a workaround or mitigation in either CVE entry. The remaining option is to install the patches.

1. Check the current build using the command below on a server in the farm.
2. Prepare the prerequisites If you use SharePoint Workflow Manager, install KB5002799 in the farm first. If you use Classic Workflow Manager, enable debug flag 53601 as described on the KB page, or it will no longer work.
3. Download the packages from Microsoft Update Catalog or Download Center (Subscription Edition uses uber-subscription-kb5002893-fullfile-x64-glb.exe, while 2019 uses sts2019-kb5002894-fullfile-x64-glb.exe). Verify SHA256 against the value listed on the KB page.
4. Install on one server at a time, then run the configuration wizard following the SharePoint update guide for your version (the KB5002893 page does not describe this step), then check the build.
5. Check the build again to confirm it has reached the number in the table.

# รันใน SharePoint Management Shell
(Get-SPFarm).BuildVersion
Get-SPServer | Select-Object Name, Role, NeedsUpgrade
Get-SPContentDatabase | Select-Object Name, NeedsUpgrade

The command-line configuration wizard step, following normal SharePoint practice, is as follows (the KB pages I read link to download pages and do not include this command; use the download page for your version as the primary reference).

$hive = Join-Path $env:CommonProgramFiles 'Microsoft Shared\Web Server Extensions\16'
& "$hive\BIN\PSConfig.exe" -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

While you cannot yet install the patches, the Canadian Centre recommends in AL26-017 (which covers the July set of CVEs, not just these two) reducing the attack surface, for example by enabling AMSI integration and setting AMSI Request Body Scan Mode to Full where possible, restricting internet access, and restricting access to Central Administration. This is general hardening, not a workaround issued by Microsoft for these two vulnerabilities, and it does not replace patching.

Check whether you have been compromised

Microsoft provides no IOCs in either CVE entry, and Rapid7 has no IOC list on the page I read. CISA flags forensic triage as Yes for both KEV entries, which means you still need to investigate past activity after patching. Advisory AL26-017 provides behavioral indicators, such as unexpected privilege escalation, unusual authentication attempts, suspicious access to IIS machine keys, signs of deserialization or web shells, and SharePoint-related Defender and AMSI alerts.

The two checks I recommend below are my own methods, not official IOCs. First, look at Defender alerts.

Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-Windows Defender/Operational'; Id = 1116, 1117 } -MaxEvents 50 -ErrorAction SilentlyContinue |
  Format-Table TimeCreated, Id, Message -Wrap

Second, look for web page files created or modified after the first patch was released. The results will include files from the patches themselves, so compare them with your patch installation times. Files that nobody can explain need further investigation.

$hive = Join-Path $env:CommonProgramFiles 'Microsoft Shared\Web Server Extensions\16'
Get-ChildItem -Path $hive -Recurse -Include *.aspx, *.ashx, *.asmx -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt [datetime]'2026-07-14' } |
  Sort-Object LastWriteTime -Descending |
  Select-Object -First 50 FullName, CreationTime, LastWriteTime

Personally, if SharePoint is directly exposed to the internet and its build is still below the August patch build, I would patch it before other work in the nearest maintenance window, then investigate past activity straight away. If it is used only on an internal network with restricted access and a small number of accounts, deferring to the next window is acceptable, but it should not remain outstanding for more than a month, depending on the risks at each site.

P.S. As for 2016 and 2019, which have reached end of life, there are still KBs to install this round, but I do not know whether there will be any next round.

Sources: Microsoft MSRC CVRF for Jul. and Aug. 2026 (https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Jul, https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Aug), CISA KEV (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-55040, https://nvd.nist.gov/vuln/detail/CVE-2026-65660), Microsoft Support KB5002893 (https://support.microsoft.com/help/5002893) and KB5002894 (https://support.microsoft.com/help/5002894), Microsoft Lifecycle SharePoint Server 2019 (https://learn.microsoft.com/en-us/lifecycle/products/sharepoint-server-2019), Canadian Centre for Cyber Security AL26-017 (https://cyber.gc.ca/en/alerts-advisories/al26-017-critical-vulnerabilities-impacting-microsoft-sharepoint-server-cve-2026-56164-cve-2026-55040-cve-2026-58644), Rapid7 (https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed) Information current as of 5 Nov. 2026. I will come back and update this later.