Meta News

Attackers have begun exploiting a critical Microsoft SharePoint vulnerability shortly after researchers released public proof-of-concept code, once again demonstrating how quickly technical vulnerability research can move from disclosure into real-world attacks.

The vulnerability, tracked as CVE-2026-55040, carries a CVSS score of 9.1 and affects the authentication mechanisms used by on-premises Microsoft SharePoint Server. Microsoft patched the flaw as part of its July 2026 security updates, but organizations that have not yet applied those fixes are now facing active exploitation attempts.

The flaw is particularly serious because it can allow a remote attacker without valid credentials to bypass authentication and impersonate legitimate SharePoint users. Depending on the targeted identity, an attacker could potentially access sensitive files, modify information or operate with administrative privileges inside a vulnerable SharePoint environment.

At the center of CVE-2026-55040 is SharePoint’s handling of JSON Web Tokens, or JWTs. These tokens are commonly used to establish identity between applications and services, allowing systems to determine whether a request should be trusted without requiring users to repeatedly authenticate.

Rapid7 researchers found several weaknesses in SharePoint’s JWT validation pipeline that can be chained together. Rather than defeating a single security check, an attacker can manipulate different parts of the token-validation process until SharePoint accepts a forged identity as legitimate.

The attack chain ultimately allows an unauthenticated remote attacker to construct a token capable of impersonating an arbitrary SharePoint site user. This is particularly dangerous because identity is the foundation upon which the rest of SharePoint’s authorization system operates. Once the server incorrectly accepts the attacker’s forged identity, subsequent activity may appear to originate from a legitimate user.

Microsoft describes the vulnerability as a security-feature bypass caused by weak authentication. Successful exploitation can allow attackers to disclose files and modify information, although the vulnerability by itself does not directly affect system availability.

The vulnerability had already been patched, but the security situation changed considerably when Rapid7 published technical details and a Python-based proof-of-concept exploit.

The PoC demonstrates how forged JWT tokens can be used against a vulnerable SharePoint installation. It can query the target’s domain controller, enumerate users through their security identifiers and automatically identify a SharePoint site administrator that can then be impersonated.

That publication appears to have accelerated exploitation. Defused Cyber reported threat actors using the public PoC against real systems, while telemetry collected by KEVIntel recorded 12 exploitation attempts since July 19. Eight of those attempts occurred on August 12 and 13, immediately around the public release of the exploit code.

The observed activity originated from eight unique IP addresses associated with infrastructure in Hong Kong, Japan, the Netherlands, Taiwan and the United States. At present, researchers have not identified the operators behind the attacks or established their ultimate objectives.

The relatively small number of observed attempts should not provide much reassurance. Public telemetry captures only part of global exploitation activity, and once functional exploit code becomes available, incorporating it into automated vulnerability scanners becomes considerably easier.

CVE-2026-55040 is not an isolated incident. It is already the fifth SharePoint vulnerability known to have been exploited during 2026, following CVE-2026-45659, CVE-2026-56164, CVE-2026-58644 and CVE-2026-50522.

That concentration reflects SharePoint’s value to attackers. On-premises installations frequently contain corporate documents, internal communications, intellectual property and other sensitive information, while also maintaining connections to broader Microsoft identity and enterprise infrastructure.

An exposed SharePoint server can therefore provide considerably more than access to documents. Depending on the vulnerability and configuration, successful exploitation may become an entry point for credential theft, persistence, lateral movement or additional attacks against the surrounding Windows environment.

This makes internet-facing SharePoint installations especially attractive. Attackers can continuously scan for vulnerable servers and attempt exploitation without first compromising an employee workstation or delivering a phishing email.

Although CVE-2026-55040 is not itself a remote-code-execution vulnerability, its ability to defeat authentication makes it useful as part of a broader exploit chain.

Rapid7 originally investigated the flaw as part of its Pwn2Own Berlin research and demonstrated that authentication bypasses of this kind can potentially be combined with vulnerabilities available only to authenticated SharePoint users.

This distinction is important when evaluating risk. A vulnerability should not be assessed solely according to what it accomplishes independently. Attackers routinely combine weaknesses so that one vulnerability removes the security barrier protecting another.

An authentication bypass can therefore transform a vulnerability requiring legitimate SharePoint access into something remotely exploitable by anyone on the internet.

That chaining potential is one reason authentication vulnerabilities deserve particular attention even when they do not directly provide operating-system code execution.

The SharePoint attacks also reinforce a broader change in vulnerability management. Organizations once had some expectation of time between technical disclosure and widespread exploitation. That window is rapidly disappearing.

Security researchers, offensive-security companies and vendors routinely publish detailed technical analyses and proof-of-concept code after patches become available. These publications are valuable to defenders because they explain vulnerabilities and allow organizations to test whether protections work.

Attackers consume the same information.

Once reliable PoC code becomes publicly available, much of the difficult vulnerability research has already been completed. Threat actors can adapt the exploit, integrate it into scanning infrastructure and begin searching the internet for systems that missed the update.

CVE-2026-55040 provides a clear example: the vulnerability was patched in July, technical exploitation details became publicly accessible, and a noticeable increase in attack activity followed.

For enterprise defenders, this increasingly means that patch availability—not evidence of exploitation—must start the remediation clock.

The attacks also highlight an important distinction between cloud-hosted services and self-managed enterprise software.

Organizations running on-premises SharePoint remain responsible for maintaining the servers, applying security updates, monitoring exposure and investigating suspicious activity. A patch released by Microsoft provides no protection until administrators actually deploy it.

Legacy infrastructure makes this particularly challenging. Enterprise collaboration platforms are often deeply integrated with authentication systems, custom applications and business workflows, making immediate updates operationally difficult.

Attackers understand that delay.

The gap between the publication of a security update and its deployment across thousands of organizations creates a predictable population of vulnerable systems. Public exploit code makes finding those systems considerably easier.

Organizations operating affected SharePoint Server environments should ensure that Microsoft’s July 2026 security updates have been applied. Systems exposed directly to the internet deserve particular attention given the confirmed exploitation activity.

Security teams should also review historical telemetry rather than assuming that installing the patch concludes the incident. Authentication logs, SharePoint activity, unusual user impersonation, unexpected access to sensitive documents and anomalous requests originating from external infrastructure may provide evidence that exploitation occurred before remediation.

The broader lesson from CVE-2026-55040 is increasingly familiar but difficult to ignore. Modern vulnerability exploitation operates at internet speed. A security flaw can move from research to public proof of concept and then into active attacks before many organizations have completed ordinary patch-management procedures.

For SharePoint administrators, that theoretical window has already closed. CVE-2026-55040 is patched, the exploit is public, and attackers are now using it.