Hackers Exploit Microsoft SharePoint Vulnerability After PoC Release

Attackers have started exploiting CVE-2026-55040, a SharePoint Server vulnerability that Microsoft patched in its July security updates. The flaw allows them to bypass authentication and impersonate a SharePoint user or administrator, then potentially access and modify data stored on the SharePoint server.

In its July security updates, Microsoft describes CVE-2026-55040 as a weak authentication vulnerability, stating that exploiting it “could allow an attacker to disclose files and modify data, but the attacker cannot impact the availability of the system.”

Rapid7 offered a detailed technical analysis of CVE-2026-55040 in a blog post published on August 11. The post outlines the source of the vulnerability and shows how it could be exploited to bypass authentication and carry out operations.

The company describes it as a flaw in SharePoint Server Subscription Edition’s system for validating JSON Web Token (JWT) authentication tokens. It identifies the root cause as “a chain of four distinct weaknesses that, when combined, allow an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user.”

Along with its analysis, Rapid7 posted PoC code for reproducing the attack.
On August 12, the cyber intelligence platform Defused reported that its SharePoint honeypots recorded several exploitation attempts, with attackers using the PoC released by Rapid7. 

CVE-2026-55040 is the fifth SharePoint vulnerability that was reportedly exploited this summer, after CVE-2026-50522, CVE-2026-58644, CVE-2026-56164, and CVE-2026-45659. Due to this surge in the exploitation of SharePoint vulnerabilities, CISA recently posted an alert advising organizations to promptly patch their SharePoint servers and report anomalous activity to its operations center.

In its recent post, Rapid7 also showed that if exploited in conjunction with another SharePoint vulnerability (CVE-2026-63520), the CVE-2026-55040 flaw could allow unauthenticated attackers to execute code remotely. Microsoft patched CVE-2026-63520 in its August Patch Tuesday updates and there is currently no indication that attackers are exploiting it.