Canton shops that keep vendor lists, invoices, and booth maps in Microsoft 365 have a real patch job this week. On Tuesday, August 18, 2026, CISA (Cybersecurity and Infrastructure Security Agency) added four holes to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation.
The two that land on a Van Zandt business are SharePoint weak authentication (CVE-2026-55040) and Windows IKE (Internet Key Exchange, CVE-2026-33824). Security Affairs recapped it Aug 19: the SharePoint issue can impersonate a site user, including an admin, without a normal login.
First Monday week is a bad time for a shared folder to look open to the wrong account. Call (903) 675-5431 if you want that checked from Athens.
1. Confirm Windows updates are actually installed on your clients and any locally installed SharePoint if you host your own server. A 365 tenant still needs tenant-side fixes and a look at who can reach which sites.
2. If IKE or a related VPN is on, patch it. CISA listed it because it is already being used.
3. After the patch, review SharePoint sign-ins and sudden site-owner changes.
My I.T. Consultants, 109 S. Murchison St., Suite C, Athens. Managed IT for businesses.
Sources:
