Attackers have begun testing Microsoft SharePoint vulnerability CVE-2026-55040 against internet-facing systems after public proof-of-concept code became available, according to reports published on August 12 and 13. The critical authentication bypass can let an unauthenticated remote attacker impersonate a SharePoint user or administrator. Microsoft patched the flaw in July, but had not marked it as successfully exploited when BleepingComputer reported the new activity.

Rapid7 disclosed CVE-2026-55040 with Microsoft on July 14 and released a technical analysis and Python proof of concept on August 11. Defused Cyber subsequently observed code based on that proof of concept reaching its SharePoint honeypots. The Hacker News reported that the actor and ultimate objective remain unknown, while telemetry cited by the publication recorded a rise in attempts on August 12 and 13.

Rapid7 traced the weakness to SharePoint Server Subscription Edition's JSON Web Token validation pipeline. Its analysis found four validation failures that can be chained to forge a token, including acceptance of an unsigned outer token, unsafe resolution of a certificate thumbprint, permissive issuer handling and a signature check that does not perform cryptographic verification.

A successful attacker can supply an identity claim for a chosen Windows security identifier or user principal name and act with that account's SharePoint permissions. Microsoft states that exploitation may expose files and permit data modification, although the flaw does not allow an attacker to affect availability by itself. Rapid7 demonstrated the bypass on SharePoint Server Subscription Edition; Microsoft also issued July fixes for affected SharePoint Enterprise Server 2016 and SharePoint Server 2019 installations.

The exposure is potentially broad: Shadowserver was tracking more than 8,500 SharePoint servers reachable from the internet, although that figure does not show which systems are vulnerable, patched or honeypots. No confirmed victim count has been published, and the honeypot activity alone does not establish that production organizations were compromised.

Administrators should apply Microsoft's security updates, verify patch status across every SharePoint farm and investigate unexpected authenticated actions. CISA has advised organizations to avoid direct internet exposure where possible, block external access to SharePoint Central Administration, restrict farm and database communications, and place necessary public services behind a Layer 7 reverse proxy or comparable application-layer control.