Attackers are actively exploiting a critical vulnerability in Microsoft SharePoint, tracked as CVE-2026-55040, following the public release of proof-of-concept (PoC) exploit code. The flaw, which allows for authentication bypass and impersonation, was addressed by Microsoft in its July 2026 Patch Tuesday updates.
The vulnerability enables a remote, unauthenticated attacker to bypass authentication on a vulnerable SharePoint server and execute operations as an authenticated SharePoint site user or administrator. Microsoft confirmed that exploitation could lead to file disclosure and data modification, but would not affect system availability.
Rapid7 researcher Stephen Fewer published a detailed technical analysis of CVE-2026-55040, along with the PoC exploit code. Fewer attributed the vulnerability to multiple issues within the JSON Web Token (JWT) validation pipeline used by SharePoint.
Threat intelligence firm Defused reported on X that attackers are already leveraging Rapid7's PoC against its SharePoint honeypots. While Microsoft has not yet officially confirmed in-the-wild exploitation, the company has flagged the flaw as a likely target for attackers.
NHS England Digital highlighted that CVE-2026-55040, when chained with another vulnerability, CVE-2026-63520, could result in unauthenticated remote code execution on affected SharePoint servers.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning to administrators, urging them to strengthen their SharePoint deployments. CISA's advisory cited active exploitation of other vulnerabilities within the platform and recommended adherence to Microsoft's official SharePoint hardening documentation.
CISA specifically advised against directly exposing SharePoint Servers to the internet unless absolutely necessary. If direct exposure is unavoidable, CISA recommended configuring SharePoint Servers behind a Layer 7 reverse proxy or a comparable application-layer security control that enforces authentication and can inspect and filter incoming requests.
