A proof-of-concept (PoC) exploit for a critical authentication bypass vulnerability in Microsoft SharePoint, identified as CVE-2026-55040, is reportedly being actively used in attacks. Cybersecurity firm Rapid7 published a detailed technical write-up and the PoC exploit code on Tuesday, August 11, 2026.
The vulnerability, an authentication bypass in the JWT token validation pipeline, allows unprivileged attackers to perform operations as a SharePoint site user or administrator. Microsoft addressed this flaw in its July 2026 Patch Tuesday updates, urging customers to patch SharePoint Enterprise Server 2016 and SharePoint Server 2019.
Microsoft described the vulnerability as allowing impersonation through a bypass of the authentication feature. Exploitation could lead to file disclosure and data modification, but Microsoft stated that system availability would not be impacted.
Threat intelligence company Defused reported on August 12, 2026, that Rapid7's exploit code was already being weaponized against its SharePoint honeypots. This indicates that attackers quickly adopted the publicly available PoC.
Despite these reports of active exploitation, Microsoft has not yet officially flagged CVE-2026-55040 as successfully exploited in the wild. However, based on Microsoft's exploitability assessment, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a warning to network defenders on July 15, 2026, advising them to secure their SharePoint servers against potential attacks.
CISA's recommendations included avoiding direct exposure of SharePoint servers to the internet unless absolutely necessary and reviewing Microsoft's official security-hardening guidance for SharePoint Server. The agency also advised blocking external access to SharePoint Central Administration and restricting farm and database communication to only essential systems. For servers requiring internet exposure, CISA suggested placing them behind a Layer 7 reverse proxy or similar application-layer security control.
The internet threat watchdog Shadowserver currently tracks over 8,500 Microsoft SharePoint servers exposed online, though it is unclear how many of these are honeypots or have been patched against CVE-2026-55040.
Since November 2021, CISA has identified 14 actively exploited Microsoft SharePoint vulnerabilities, with eight of these also being leveraged in ransomware attacks. Separately, CISA also confirmed on Tuesday that CVE-2026-45659, a high-severity Microsoft SharePoint remote code execution vulnerability actively exploited since early July, is now also being exploited by ransomware groups.
