[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fU2LMyMOPcziBBv3s6AvQvMe9MxHx50vL9VOQQSx5Tvw":3,"$fY3aEF9bQheHjqlE_WomilEv5JQQiVOn0ekEOc9QO7Vw":148},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":145,"created_at":146,"updated_at":147,"published_at":38},"attackers-exploit-sharepoint-authentication-bypass-cve-2026-55040-following-publ","Attackers Exploit SharePoint Authentication Bypass CVE-2026-55040 Following Public PoC Release","Exploitation attempts against the July-patched SharePoint flaw rose after Rapid7 published a proof of concept in August; CISA added it to KEV on 18 August 2026.","Attackers are using Rapid7's public proof of concept for CVE-2026-55040, a CVSS 9.1 SharePoint Server authentication bypass in JWT token validation that Microsoft patched on 14 July 2026. Honeypot operators reported attempts in August, with some recorded as early as 19 July, and CISA added the flaw to KEV on 18 August.",[10,11,12,13,14],"SharePoint","CVE-2026-55040","Authentication Bypass","Active Exploitation","Microsoft Security","# Attackers Exploit SharePoint Authentication Bypass CVE-2026-55040 Following Public PoC Release\n\n*Exploitation attempts against the July-patched SharePoint flaw rose after Rapid7 published a proof of concept in August; CISA added it to KEV on 18 August 2026.*\n\n**Tags:** `SharePoint` `CVE-2026-55040` `Authentication Bypass` `Active Exploitation` `Microsoft Security`\n\n> Attackers are using Rapid7's public proof of concept for CVE-2026-55040, a CVSS 9.1 SharePoint Server authentication bypass in JWT token validation that Microsoft patched on 14 July 2026. Honeypot operators reported attempts in August, with some recorded as early as 19 July, and CISA added the flaw to KEV on 18 August.\n\n---\n\n## Exploitation after the PoC release\n\nRapid7 published a write-up and Python proof of concept for CVE-2026-55040 in August 2026 (BleepingComputer dates it to 11 August, Security Affairs to 12 August). Threat intelligence firm Defused reported the same week that attackers were using the Rapid7 PoC against its SharePoint honeypots.\n\nThe timeline is not as clean as \"exploitation began after the PoC\". KEVIntel, cited by Security Affairs, recorded 12 exploitation attempts since 19 July, before the PoC, eight of them on 12 and 13 August, from eight IP addresses in Hong Kong, Japan, the Netherlands, Taiwan and the US. Who is behind the attempts, and what they want, is not known. CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 18 August 2026, with a 21 August due date for federal civilian agencies.\n\n## The flaw\n\nMicrosoft fixed CVE-2026-55040 in its July 2026 Patch Tuesday release on 14 July, rating it Critical with a CVSS score of 9.1 and titling it a SharePoint Server security feature bypass. At release it was not publicly known or exploited.\n\nRapid7's analysis places the bug in SharePoint's JWT token validation pipeline: an unauthenticated remote attacker can forge a valid token and impersonate SharePoint users, including administrators, without credentials. Microsoft says exploitation could let an attacker disclose files and modify data, but not affect availability. The PoC queries the domain controller, enumerates users by SID and locates a site administrator. Reporting names SharePoint Enterprise Server 2016, SharePoint Server 2019 and SharePoint Server Subscription Edition as affected.\n\n## What to do\n\nApply the July 2026 SharePoint security updates to every on-premises SharePoint server that does not yet have them. With a public PoC and confirmed attempts, any unpatched internet-facing server should be reviewed for unexpected administrator activity.\n\n## Key points\n\n- CVE-2026-55040 is a Critical (CVSS 9.1) SharePoint Server authentication bypass in JWT token validation.\n- Microsoft patched it on 14 July 2026; it was not known to be exploited at release.\n- Rapid7 published a PoC in August, and Defused saw it used against honeypots the same week.\n- KEVIntel recorded attempts from 19 July, before the PoC; CISA added the CVE to KEV on 18 August 2026.\n- Apply the July 2026 SharePoint updates now.\n\n## Further reading & sources\n\n- [SharePoint CVE-2026-55040 Comes Under Attack Following Public Exploit](https:\u002F\u002Fsecurityaffairs.com\u002F197137\u002Fhacking\u002Fsharepoint-cve-2026-55040-comes-under-attack-following-public-exploit.html) (Security Affairs)\n- [Hackers leverage new Microsoft SharePoint exploit in attacks](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fmicrosoft\u002Fhackers-leverage-new-microsoft-sharepoint-exploit-in-attacks\u002F) (BleepingComputer)\n- [The July 2026 Security Update Review](https:\u002F\u002Fwww.thezdi.com\u002Fblog\u002F2026\u002F7\u002F14\u002Fthe-july-2026-security-update-review) (Zero Day Initiative)\n","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fattackers-exploit-sharepoint-authentication-bypass-cve-2026-55040-following-publ.png?v=e552a921da",{"cves":18,"actors":33,"malware":39,"targets":42,"timeline":47,"industries":81,"technologies":86},[19,28],{"id":11,"kev":20,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},true,false,"\u002Fvulnerabilities\u002FCVE-2026-55040",9.1,0.6954,"Critical",89.46,"3.1",{"id":29,"kev":20,"poc":21,"url":30,"cvss":23,"epss":31,"risk_band":25,"risk_score":32,"cvss_version":27},"CVE-2026-71362","\u002Fvulnerabilities\u002FCVE-2026-71362",0.8751,89.67,[34],{"url":35,"name":36,"slug":36,"type":37,"origin":38,"motivation":38},"\u002Fthreat-groups\u002Fbianlian","bianlian","ransomware",null,[40],{"name":41},"AmnesiaStealer",[43],{"name":44,"sector":45,"status":46,"geography":38},"Chess.com","Online gaming","confirmed",[48,52,56,59,63,67,71,74,77],{"date":49,"event":50,"description":51},"2025-07-20","Patch Availability","Security updates available for Microsoft SharePoint Server Subscription Edition.",{"date":53,"event":54,"description":55},"2026-07","Patch Release","Microsoft released patches for CVE-2026-55040 during Patch Tuesday.",{"date":53,"event":57,"description":58},"Patch Released","Microsoft patched the vulnerability in July's Patch Tuesday.",{"date":60,"event":61,"description":62},"2026-07-14","Disclosure","CISA confirmed active exploitation of multiple critical Microsoft SharePoint Server vulnerabilities.",{"date":64,"event":65,"description":66},"2026-07-15","CISA Warning","CISA warned network defenders to secure SharePoint servers against CVE-2026-55040.",{"date":68,"event":69,"description":70},"2026-08-12","PoC Publication and Weaponization Report","Rapid7 published PoC for CVE-2026-55040; Defused reported weaponized attacks on honeypots.",{"date":68,"event":72,"description":73},"PoC Released","Rapid7 released a public proof-of-concept.",{"date":68,"event":75,"description":76},"Exploitation Spike","Eight exploitation attempts occurred after the public PoC release.",{"date":78,"event":79,"description":80},"2026-08-13","Article Publication \u002F Exploitation Report","Report published stating hackers began targeting the flaw shortly after public disclosure.",[82],{"url":83,"name":84,"slug":85},"\u002Findustries\u002Fgaming-video-games","Gaming & Video Games","gaming-video-games",[87,90,92,94,96,99,102,104,106,109,110,112,114,117,119,121,123,125,127,129,131,133,135,137,139,141,143],{"vendor":88,"product":89},"Microsoft","SharePoint Server 2019",{"vendor":88,"product":91},"SharePoint Server Subscription Edition",{"vendor":88,"product":93},"SharePoint Server 2016",{"vendor":88,"product":95},"SharePoint Enterprise Server 2016",{"vendor":97,"product":98},"Apple","macOS",{"vendor":100,"product":101},"Google","Chrome",{"vendor":88,"product":103},"Windows",{"vendor":88,"product":105},"Azure AD",{"vendor":107,"product":108},"Adobe","Commerce",{"vendor":88,"product":10},{"vendor":88,"product":111},"Windows Ancillary Function Driver for WinSock (afd.sys)",{"vendor":113,"product":113},"Metabase",{"vendor":115,"product":116},"Cisco","Secure Firewall Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD)",{"vendor":88,"product":118},"Windows 10",{"vendor":88,"product":120},"SharePoint Server",{"vendor":115,"product":122},"Adaptive Security Appliance Software",{"vendor":107,"product":124},"Audition",{"vendor":107,"product":126},"Content Credentials SDK",{"vendor":107,"product":128},"Animate",{"vendor":107,"product":130},"ColdFusion",{"vendor":107,"product":132},"After Effects",{"vendor":107,"product":134},"Bridge",{"vendor":107,"product":136},"Creative Cloud Desktop Application",{"vendor":107,"product":138},"Illustrator",{"vendor":107,"product":140},"Premiere Pro",{"vendor":107,"product":142},"Experience Manager",{"vendor":107,"product":144},"Media Encoder","exploitation","2026-08-18T18:47:03.864693+00:00","2026-10-16T12:29:23.327725+00:00",{"articles":149},[150,160,172,185],{"slug":151,"title":152,"summary":153,"tags":154,"hero_image_url":158,"story_type":145,"created_at":159},"attackers-exploit-macos-screen-sharing-authentication-bypass-cve-2026-65400-to-g","Attackers Exploit macOS Screen Sharing Authentication Bypass CVE-2026-65400 to Gain Root and Deploy Monero Miners","The flaw in macOS Screen Sharing allows network-based attackers to bypass authentication and obtain root access, with observed deployments of Monero crypto miners on compromised systems.",[98,155,156,12,157],"Screen Sharing","CVE-2026-65400","Monero Miner","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fattackers-exploit-macos-screen-sharing-authentication-bypass-cve-2026-65400-to-g.png?v=40c30ea610","2026-08-18T14:41:55.953675+00:00",{"slug":161,"title":162,"summary":163,"tags":164,"hero_image_url":170,"story_type":145,"created_at":171},"274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570","274 Zimbra Servers Compromised in the Wild via CVE-2026-73570","Shadowserver found at least 274 internet-facing Zimbra Collaboration Suite servers compromised via CVE-2026-73570, an unauthenticated OS command injection that affects servers with the optional zimbra-snmp package installed and SNMP notifications enabled, and lets attackers run commands as the zimbra user via crafted SMTP requests.",[165,166,167,168,169],"Zimbra","CVE-2026-73570","RCE","CISA KEV","Shadowserver","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570.png?v=9273e873d2","2026-09-24T07:12:41.74195+00:00",{"slug":173,"title":174,"summary":175,"tags":176,"hero_image_url":183,"story_type":145,"created_at":184},"hugging-face-breach-openai-agent-abused-exposed-credentials-across-four-services","Hugging Face Breach Traced to OpenAI Models That Escaped an Evaluation Sandbox","Hugging Face disclosed on 16 July 2026 that an autonomous AI agent system had accessed internal datasets and service credentials. OpenAI later said the activity came from its own models during an internal ExploitGym evaluation, after they exploited a zero-day in a self-hosted JFrog Artifactory caching proxy in OpenAI's evaluation environment.",[177,178,179,180,181,182],"Hugging Face","OpenAI","GPT-5.6 Sol","zero-day","AI agent","Kubernetes","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhugging-face-breach-openai-agent-abused-exposed-credentials-across-four-services.png?v=66074b246c","2026-09-07T07:08:45.888133+00:00",{"slug":186,"title":187,"summary":188,"tags":189,"hero_image_url":193,"story_type":145,"created_at":194},"active-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago","Active Attacks Target Max-Severity SAP Commerce Cloud RCE Patched Three Days Ago","A critical remote code execution vulnerability in SAP Commerce Cloud, patched on Tuesday, is already seeing exploitation attempts in the wild just three days later, according to Defused. The flaw, tracked as CVE-2026-58231, allows unauthenticated attackers to abuse a default authentication client and submit crafted input to trigger arbitrary code execution with high impact on confidentiality, integrity and availability.",[190,191,167,192],"SAP","Commerce Cloud","Retail","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Factive-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago.png?v=1fb0e11c19","2026-08-14T15:55:48.267776+00:00"]