This vulnerability, identified as CVE-2026-55040 and classified under CWE-1390 (Weak Authentication), affects Microsoft SharePoint Enterprise Server 2016 version 16.0.0. It enables an attacker with no privileges and no user interaction to bypass authentication controls remotely. The CVSS 3.1 base score is 9.1, indicating a critical severity with network attack vector, low attack complexity, and no required privileges or user interaction. Microsoft has published an official fix for this vulnerability.

Successful exploitation allows an attacker to bypass authentication mechanisms, resulting in high confidentiality and integrity impact on the affected SharePoint server. This could enable unauthorized access to sensitive information and unauthorized modification of data. Availability impact is not affected. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040 to remediate this vulnerability. Since this is not a cloud service, patching the affected on-premises SharePoint Enterprise Server 2016 is required to mitigate the risk.