Microsoft August Patch Tuesday 2026: Patch SharePoint Now

Today’s August Patch Tuesday closes what July left open. Last month, Microsoft patched CVE-2026-55040 — a critical JWT authentication bypass that let unauthenticated attackers impersonate any SharePoint user or administrator. That stopped the first half of an attack chain. The second half — the remote code execution vulnerability that completes the path to arbitrary code execution — was embargoed until today. It is now patched. If you ran July’s update and assumed you were done, you are not.

One Chain, Two CVEs

CVE-2026-55040 (CVSS 9.1) is a flaw in SharePoint’s JWT token validation pipeline. An unauthenticated attacker who knows a target’s Active Directory Security ID or User Principal Name can forge a token the server accepts as legitimate and operate as that user — including as a site administrator. Rapid7 researcher Stephen Fewer discovered and demonstrated the vulnerability at Pwn2Own Berlin.

The August CVE builds on that access. Once an attacker has impersonated an admin through the auth bypass, the RCE vulnerability converts that impersonation into arbitrary code execution on the SharePoint Server itself. Together, the chain requires no credentials whatsoever: any internet-accessible SharePoint Server is a potential entry point.

Both CVEs affect SharePoint Server Subscription Edition, 2019, and 2016. SharePoint Online is not affected — if you are fully on Microsoft 365, you are not exposed here.

There Is Already an Active Threat Actor Targeting These Servers

This is not a theoretical risk. Storm-2603, the group behind Warlock ransomware, has been hunting on-premises SharePoint servers since mid-2025. They already exploited CVE-2026-45659 — a separate SharePoint deserialization RCE patched in May — and used it to deploy Warlock ransomware using DLL search-order hijacking, Cloudflare tunnels, and VS Code SSH sessions to maintain persistence. Threat analysis from Hard2bit documents the full attack chain.

CISA’s response to CVE-2026-55040 was a three-day federal remediation deadline — added to the Known Exploited Vulnerabilities catalog on July 14, with a deadline of July 17. CISA only issues that timeline for vulnerabilities with confirmed in-the-wild exploitation. That deadline is a calibration point for private sector organizations: if it takes your team a week to approve and deploy a SharePoint patch, you are operating on an attacker-friendly schedule.

The Actual Patch Steps

Run these in order. Skipping steps or patching out of sequence breaks installations.

1. If you run SharePoint Workflow Manager: install KB5002799 first (prerequisite — the August update may fail without it).
2. Install the July 14 security updates if not already applied:
   • KB5002882 — SharePoint Server Subscription Edition
   • KB5002883 — SharePoint Server 2019
   • KB5002892 — SharePoint Server 2016 Language Pack
3. Install today’s August 12 updates across every server in the farm.
4. Run PSConfig after deployment on every farm server — this step is frequently skipped and leaves the farm in a broken or partially patched state.

After patching, verify your patch level:

Get-SPProduct -Local | Select DisplayName, PatchingStatus, Version

Prioritize externally accessible SharePoint instances first. Internal-only instances are lower immediate risk but should follow within 24–48 hours.

The Bigger Picture: Patch Volumes Are Only Going Up

July’s Patch Tuesday fixed 622 vulnerabilities — a 316% year-over-year increase driven by Microsoft’s MDASH system (Multi-Model Agentic Scanning Harness), which runs AI agents against the full Windows codebase around the clock to discover bugs before attackers can. Microsoft has warned that record-volume Patch Tuesdays are the new normal.

The defensive implication is uncomfortable: once a patch ships, attackers can compare old and new binaries within hours and build an exploit for the exact flaw that was just fixed. The habit of waiting a week to “let patches stabilize” now gives attackers a head start. Automated patch management is not optional for organizations running on-premises SharePoint — it is the only realistic response to a 600+ CVE-per-month environment.

If your organization is still on SharePoint Server 2016 or 2019, this month’s events are a useful prompt: both versions are approaching end of mainstream support. SharePoint Subscription Edition or SharePoint Online are the long-term paths forward. The threat actor targeting these servers is not going away.