Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040)
Attackers use Rapid7's public PoC to exploit CVE-2026-55040, a critical SharePoint authentication bypass patched in July 2026.
Rapid7 researcher Stephen Fewer published technical analysis and PoC exploit code for CVE-2026-55040, an authentication bypass in SharePoint caused by flaws in the JWT token validation pipeline. Threat intelligence firm Defused observed attackers using the PoC against SharePoint honeypots, though Microsoft has not yet confirmed in-the-wild exploitation. Chained with CVE-2026-63520, the flaw can yield unauthenticated remote code execution, per NHS England Digital. CISA is urging administrators to harden SharePoint deployments by limiting direct internet exposure and using Layer 7 reverse proxies.
- CVE-2026-55040 bypasses JWT token validation, enabling unauthenticated impersonation of SharePoint users and admins
- Defused observed attackers using the Rapid7 PoC against SharePoint honeypots
- Chained with CVE-2026-63520, the flaw enables unauthenticated remote code execution
- Microsoft patched the flaw in July 2026 Patch Tuesday updates
- CISA recommends avoiding direct internet exposure and using authentication-enforcing Layer 7 proxies
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-55040 | Authentication Bypass in Microsoft SharePoint Server Microsoft SharePoint Server is affected by a weak authentication vulnerability (CWE-1390) that allows an unauthorized attacker to bypass a security feature over a network. Per the CVSS vector, exploitation requires no privileges and no user interaction with low attack complexity, so any unauthenticated attacker with network access to a vulnerable server can trigger it remotely. Impact to confidentiality and integrity is rated high (CVSS 9.1, critical), meaning the bypass effectively grants the attacker access that authentication should have prevented, with no direct availability impact. All organizations running on-premises Microsoft SharePoint Server are potentially affected; the source data does not specify affected version ranges or fixed builds, so defenders should consult Microsoft's advisory for those details. The flaw is under active exploitation: a public proof-of-concept is available on GitHub, attackers began exploiting it after the PoC went public, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18 (EPSS ~40%, 99th percentile; ransomware association unknown). Do: Apply Microsoft's security update for CVE-2026-55040 immediately, prioritizing internet-facing SharePoint servers, and comply with CISA BOD 26-04 and the agency's Forensics Triage Requirements, including checking for signs of prior compromise on SharePoint servers. Use the public GitHub proof-of-concept to validate patching and detection coverage, and restrict network exposure of SharePoint until all servers are updated. | 9.1 | 51% | KEV PoC ×2 |
| mass≈tens of thousands of internet-exposed SharePoint Server instances, within an installed base spanning hundreds of thousands of enterprise and government… | |
| CVE-2026-63520 | Unauthenticated RCE in Microsoft SharePoint Server CVE-2026-63520 is an improper input validation flaw (CWE-20) in Microsoft Office SharePoint, affecting on-premises SharePoint Server deployments. A remote, unauthenticated attacker can trigger the flaw by sending improperly validated input to the SharePoint service over the network; the high attack complexity (AC:H) indicates exploitation depends on specific conditions, but no privileges or user interaction are required. Successful exploitation results in arbitrary code execution on the server, with high impact to confidentiality, integrity, and availability — effectively full compromise of the SharePoint host. Organizations running self-hosted SharePoint Server are in scope; SharePoint Online/Microsoft 365 is not listed in the affected products. The issue is patched as of Microsoft's Patch Tuesday (headlines mark it FIXED), with Rapid7 analysis and a researcher-disclosed exploit chain available, but there is no public PoC, no CISA KEV listing, and no confirmed in-the-wild exploitation; EPSS puts exploitation probability at 2.9% (86th percentile). Do: Apply Microsoft's Patch Tuesday security updates for SharePoint Server as soon as possible, prioritizing internet-facing farms, since the flaw requires no authentication and grants code execution. As interim mitigation, restrict network exposure of SharePoint front-ends (VPN/WAF/reverse proxy rules) and verify all farm servers receive the update. Monitor vendor advisories and the Rapid7 analysis for details on the vulnerable code paths, since no public PoC or in-the-wild exploitation has been confirmed yet. | 8.1 | 3% |
| masshundreds of thousands of on-prem SharePoint Server installations (>1M enterprise users) |
Full article275 words · extracted from helpnetsecurity.com · click to collapse
Threat actors have begun exploiting a critical Microsoft SharePoint flaw following the release of proof-of-concept (PoC) exploit code by Rapid7.
About CVE-2026-55040
Tracked as CVE-2026-55040, the vulnerability was patched by Microsoft as part of its July 2026 Patch Tuesday updates.
“The authentication feature could be bypassed as this vulnerability allows impersonation,” Microsoft said. “Exploiting this vulnerability could allow an attacker to disclose files and modify data, but the attacker cannot impact the availability of the system.”
Rapid7 researcher Stephen Fewer has published an in-depth technical analysis of the flaw, accompanied by proof-of-concept exploit code.
“A remote unauthenticated attacker can leverage CVE-2026-55040 to bypass authentication on a vulnerable SharePoint server, and perform operations as a SharePoint site user or administrator. The vulnerability is due to several issues in the JWT token validation pipeline,” Fewer explained.
Threat intelligence firm Defused warned on X that attackers are now using the Rapid7 POC for CVE-2026-55040 against its SharePoint honeypots.
Microsoft has yet to confirm the bug has been exploited in the wild, even as it flags the flaw as a likely target.
When paired with another vulnerability, CVE-2026-63520, CVE-2026-55040 “could lead to unauthenticated remote code execution against a vulnerable SharePoint server”, according to NHS England Digital.
CISA is warning administrators to harden their SharePoint deployments, citing active exploitation of several other vulnerabilities in the platform.
Defenders were also urged to follow Microsoft’s official SharePoint hardening documentation.
“Avoid exposing SharePoint Servers directly to the internet unless necessary; and if necessary, only configure a SharePoint Server behind a Layer 7 reverse proxy or equivalent application-layer security control that requires authentication and can inspect and filter requests,” CISA wrote.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/08/13/microsoft-sharepoint-cve-2026-55040-poc-exploit/