SharePoint: Proof of Concept for Critical Flaw Already Used in Attacks

CVE-2026-55040 Allows User and Administrator Impersonation

On August 12, 2026, at 08:25, Rapid7 published a technical analysis featuring a proof-of-concept exploit for CVE-2026-55040. The vulnerability affects Microsoft SharePoint Enterprise Server 2016 and Microsoft SharePoint Server 2019.

The flaw is rated critical and involves an authentication bypass in the pipeline used to validate JWT tokens. A remote, unauthenticated attacker can impersonate SharePoint site users or administrators and perform actions with the privileges of the forged identity.

An attack could therefore enable file access, data modification, and loss of confidentiality and integrity. However, it does not allow attackers to compromise system availability.

Rapid7’s Code Has Been Observed Targeting Honeypots

Defused detected Rapid7’s code, modified for operational use, targeting its SharePoint honeypots. This observation indicates that the PoC has moved beyond the research phase, although the scale of the ongoing campaigns remains unknown.

Microsoft addressed CVE-2026-55040 in the July 2026 Patch Tuesday updates and recommends applying the fixes to affected systems. Before Defused’s observation, Microsoft considered the vulnerability an attractive target but had not classified it as successfully exploited “in the wild.”

Shadowserver has identified more than 8,500 Microsoft SharePoint servers exposed online. It is not known how many have already been patched or how many correspond to honeypots.

Recommended Measures to Reduce Exposure

Administrators should install the July 2026 Microsoft updates and verify that SharePoint instances not intended to be externally accessible are not directly published to the Internet.

CISA has also recommended:

• blocking external access to SharePoint Central Administration;
• following Microsoft’s security-hardening guidance;
• restricting communications between SharePoint farms and databases to only the systems that require them;
• placing exposed servers behind a Layer 7 reverse proxy or an equivalent application-layer control.

Security teams should look for anomalous access, activity performed with administrative privileges, and unexpected changes to SharePoint files or data. No specific indicators of compromise have been provided.

Another Incident in a Series of SharePoint Attacks

The attack surface remains under pressure. Since November 2021, CISA has reported 14 Microsoft SharePoint vulnerabilities actively exploited in attacks; eight were also used in ransomware campaigns.

The source also reports ransomware campaigns exploiting CVE-2026-45659, a separate SharePoint vulnerability rated high severity and exploited since early July 2026. It should therefore not be confused with CVE-2026-55040.