SharePoint Vulnerabilities Exploited (Aug 2026): Who Is Affected

What CSA announced on 28 August 2026

CSA's alert Active Exploitation of Vulnerabilities in Microsoft SharePoint (AL-2026-113) says Microsoft is aware of attacks on two SharePoint flaws, that the vulnerabilities are reportedly being actively exploited, and that a proof-of-concept exploit is publicly available. Its recommendation is one line: update affected products to the latest versions immediately.

The two flaws were patched in Microsoft's July and August 2026 security updates. The US National Vulnerability Database lists CVE-2026-55040 as published on 14 July 2026 and added to CISA's Known Exploited Vulnerabilities catalogue on 18 August 2026. CVE-2026-63520 was published on 11 August 2026, alongside CSA's August 2026 monthly patch alert.

Is SharePoint Online in Microsoft 365 affected?

Most Singapore SMEs use SharePoint without knowing it. Every Microsoft 365 Business plan includes SharePoint Online, which stores Teams files and shared document libraries. That is a cloud service Microsoft runs and patches itself.

Both CSA's alert and the NVD product records list only SharePoint Server editions as affected. SharePoint Online is not named. So if your files live in Microsoft 365 and you have never bought or installed a SharePoint server, there is nothing to patch for these two CVEs.

Not being affected by this alert does not mean your Microsoft 365 tenant is secure. Account takeover through phishing remains the bigger risk for SharePoint Online. Our Microsoft 365 security checklist covers sharing settings, MFA and audit logging.

How to check which SharePoint your business uses

Five minutes with these checks is enough for most owners.

1. 1

   Look at the address bar when you open shared files

   If the URL is yourcompany.sharepoint.com or yourcompany-my.sharepoint.com, you are on SharePoint Online.

2. 2

   Ask whoever set up your IT

   Ask one question: do we run a SharePoint Server anywhere, on a server in the office or at a hosting provider? Get the answer in writing.

3. 3

   Check old invoices and server lists

   Look for SharePoint Server licences, Windows Server hosting contracts or an intranet built before you moved to Microsoft 365.

4. 4

   If you find a server, record its version

   Your IT provider can read the build number in SharePoint Central Administration, under Upgrade and Migration, Check product and patch installation status.

5. 5

   Compare it with the fixed builds

   Use the table in the next section. Anything lower than the listed build is vulnerable.

Affected versions and fixed builds

CSA lists the following SharePoint Server versions as affected. Builds lower than these are vulnerable.

The lifecycle entries are on Microsoft's SharePoint Server 2019 and SharePoint Server 2016 pages. The realistic options are SharePoint Server Subscription Edition if you must stay on-premises, or migrating the content to SharePoint Online.

If you run SharePoint Server: what to do this week

Because a public exploit exists, treat an unpatched internet-facing SharePoint server as possibly compromised, not just vulnerable.

If you find signs of compromise, stop and follow an incident process rather than just patching. Our ransomware response guide explains the first hour, evidence preservation and who to notify, including CSA's SingCERT reporting channel.

What this alert teaches small businesses

On-premises servers that nobody owns are a recurring problem. They were set up by a vendor years ago, still run, and drop off everyone's patch list. When a flaw like this appears, the business only finds out the server exists after it has been attacked.

Keep a one-page list of every server, what it does, who patches it and when its support ends. The same habit would have caught Office 2021 and Windows 10 reaching end of support this year.

Do it yourself or get help?

If you are on Microsoft 365 only, confirm that and move on; no patch is needed for these CVEs. If you run SharePoint Server, patching and log review are a job for whoever administers that server, today.

Our Security Health Check (S$290) maps your servers, accounts and exposed services so forgotten systems like an old intranet surface before attackers find them. For Microsoft 365 tenants, the Microsoft 365 / Google Security Lockdown (S$590) tightens sharing, sign-in and audit settings. Our guide to passkeys for business covers the sign-in side.