Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040)
Attackers use Rapid7's public PoC to exploit CVE-2026-55040, a critical SharePoint authentication bypass patched in July 2026.
Rapid7 researcher Stephen Fewer published technical analysis and PoC exploit code for CVE-2026-55040, an authentication bypass in SharePoint caused by flaws in the JWT token validation pipeline. Threat intelligence firm Defused observed attackers using the PoC against SharePoint honeypots, though Microsoft has not yet confirmed in-the-wild exploitation. Chained with CVE-2026-63520, the flaw can yield unauthenticated remote code execution, per NHS England Digital. CISA is urging administrators to harden SharePoint deployments by limiting direct internet exposure and using Layer 7 reverse proxies.
- CVE-2026-55040 bypasses JWT token validation, enabling unauthenticated impersonation of SharePoint users and admins
- Defused observed attackers using the Rapid7 PoC against SharePoint honeypots
- Chained with CVE-2026-63520, the flaw enables unauthenticated remote code execution
- Microsoft patched the flaw in July 2026 Patch Tuesday updates
- CISA recommends avoiding direct internet exposure and using authentication-enforcing Layer 7 proxies
- Products
- SharePoint
- Organizations
- Defused
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-55040 | Authentication Bypass in Microsoft SharePoint Server | 9.1 | 70% | KEVPoC ×2 | KEV |
| CVE-2026-63520 | Unauthenticated RCE in Microsoft SharePoint Server | 8.1 | 3% |
From the original article
1 min read at helpnetsecurity.com
Threat actors have begun exploiting a critical Microsoft SharePoint flaw following the release of proof-of-concept (PoC) exploit code by Rapid7. Tracked as CVE-2026-55040, the vulnerability was patched by Microsoft as part of its July 2026 Patch Tuesday updates . “The authentication feature could be bypassed as this vulnerability allows impersonation,” Microsoft said .
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.