Exploitation after the PoC release
Rapid7 published a write-up and Python proof of concept for CVE-2026-55040 in August 2026 (BleepingComputer dates it to 11 August, Security Affairs to 12 August). Threat intelligence firm Defused reported the same week that attackers were using the Rapid7 PoC against its SharePoint honeypots.
The timeline is not as clean as "exploitation began after the PoC". KEVIntel, cited by Security Affairs, recorded 12 exploitation attempts since 19 July, before the PoC, eight of them on 12 and 13 August, from eight IP addresses in Hong Kong, Japan, the Netherlands, Taiwan and the US. Who is behind the attempts, and what they want, is not known. CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 18 August 2026, with a 21 August due date for federal civilian agencies.
The flaw
Microsoft fixed CVE-2026-55040 in its July 2026 Patch Tuesday release on 14 July, rating it Critical with a CVSS score of 9.1 and titling it a SharePoint Server security feature bypass. At release it was not publicly known or exploited.
Rapid7's analysis places the bug in SharePoint's JWT token validation pipeline: an unauthenticated remote attacker can forge a valid token and impersonate SharePoint users, including administrators, without credentials. Microsoft says exploitation could let an attacker disclose files and modify data, but not affect availability. The PoC queries the domain controller, enumerates users by SID and locates a site administrator. Reporting names SharePoint Enterprise Server 2016, SharePoint Server 2019 and SharePoint Server Subscription Edition as affected.
What to do
Apply the July 2026 SharePoint security updates to every on-premises SharePoint server that does not yet have them. With a public PoC and confirmed attempts, any unpatched internet-facing server should be reviewed for unexpected administrator activity.
Key points
- CVE-2026-55040 is a Critical (CVSS 9.1) SharePoint Server authentication bypass in JWT token validation.
- Microsoft patched it on 14 July 2026; it was not known to be exploited at release.
- Rapid7 published a PoC in August, and Defused saw it used against honeypots the same week.
- KEVIntel recorded attempts from 19 July, before the PoC; CISA added the CVE to KEV on 18 August 2026.
- Apply the July 2026 SharePoint updates now.
Further reading & sources
- SharePoint CVE-2026-55040 Comes Under Attack Following Public Exploit (Security Affairs)
- Hackers leverage new Microsoft SharePoint exploit in attacks (BleepingComputer)
- The July 2026 Security Update Review (Zero Day Initiative)