A working exploit for CVE-2026-55040, a 9.1-severity SharePoint authentication bypass, is hitting live servers a day after Rapid7 published it, and thousands of servers remain exposed.
- Attackers are running a fresh proof-of-concept exploit against real SharePoint servers, one day after Rapid7 published it.
- The bug, CVE-2026-55040, lets an outsider forge a login token and act as any SharePoint user, including an administrator.
- Microsoft fixed the flaw in July. Shadowserver still counts over 8,500 SharePoint servers reachable from the open internet.
Cybersecurity company Rapid7 published a proof-of-concept exploit for a critical Microsoft SharePoint authentication bypass on Tuesday, and attackers turned it against live systems within a day. Threat intelligence firm Defused said in a post on X that its SharePoint honeypots were already seeing hits from the released code. “Attackers are now using the @rapid7 POC for CVE-2026-55040 against our SharePoint honeypots,” Defused wrote, adding that Rapid7 had published its technical writeup and proof-of-concept “yesterday.”
The flaw traces back to Microsoft’s July Patch Tuesday rollout, when the company fixed SharePoint Enterprise Server 2016 and SharePoint Server 2019 against the bug and the Cybersecurity and Infrastructure Security Agency (CISA) told network defenders to lock down internet-facing SharePoint deployments. Microsoft’s own advisory described the stakes in plain terms: “The authentication feature could be bypassed as this vulnerability allows impersonation. Exploiting this vulnerability could allow an attacker to disclose files and modify data, but the attacker cannot impact the availability of the system.” The National Vulnerability Database rates the bug 9.1 out of 10, critical, under CWE-1390 for weak authentication.
🚨 Attackers are now using the @rapid7 POC for CVE-2026-55040 against our SharePoint honeypots
— Defused (@DefusedCyber) August 12, 2026
The vulnerability is a Microsoft SharePoint JWT auth bypass for which Rapid7 published a technical writeup and proof-of-concept code yesterday.
Track it live 👉… pic.twitter.com/Q8fbMyGq95
The four flaws chained inside SharePoint’s token check
Rapid7 researcher Stephen Fewer laid out the mechanism in a technical writeup published alongside the proof-of-concept code. SharePoint’s server-to-server authentication checks a JSON Web Token for identity claims, and that check runs through Microsoft’s SPJsonWebSecurityTokenHandlerV2 class. Fewer found the validation code sets RequireSignedTokens to false, so a token carrying no cryptographic signature at all passes through unchallenged.
Three more weaknesses compound the first. The handler resolves a signing certificate using a header value the attacker controls, and that value can point back to SharePoint’s own security token service certificate, one exposed on an unauthenticated metadata endpoint. Issuer validation then accepts that certificate because it isn’t registered in the specific trust list the code checks against. The final signature check only confirms a signature field is present. It never verifies the signature is cryptographically valid. Chained together, the four gaps let an unauthenticated attacker submit a self-issued token naming any user, including a domain administrator, and have SharePoint accept it.
Thousands of servers are still sitting exposed
Shadowserver, the nonprofit that tracks internet-exposed systems, counted over 8,500 Microsoft SharePoint servers reachable from the open internet this week, though it has no breakdown of how many are honeypots or already patched. That exposure sits alongside a second SharePoint bug, CVE-2026-45659, CISA confirmed this week is now being used in ransomware intrusions, months after Microsoft patched it as a lower-priority remote code execution flaw. Since November 2021, CISA has added 14 actively exploited SharePoint vulnerabilities to its Known Exploited Vulnerabilities catalog, and eight of those were later tied to ransomware. SharePoint’s exposure sits well above the norm for on-premises enterprise software in CISA’s broader disclosure data.
Administrators running on-premises SharePoint who have not applied July’s patch should treat that as today’s priority, ahead of any deeper log review. Where the patch is already in, CISA’s guidance still applies: pull SharePoint Central Administration off the public internet, restrict farm and database traffic to systems that need it, and put any internet-facing SharePoint deployment behind a Layer 7 reverse proxy. These steps help reduce risk rather than guarantee it away. Security teams can also check IIS logs for unexplained hits on the metadata endpoint or unexpected bearer-token calls to /_api/contextinfo, the pattern Rapid7’s proof-of-concept walks through to establish a session.
CISA hasn’t listed it yet, but the pattern points that way
Microsoft has not flagged CVE-2026-55040 as exploited in the wild on its own advisory, and CISA has not added it to the Known Exploited Vulnerabilities catalog as of press time, though the honeypot activity Defused logged makes that listing likely if hits reach production servers. CVE-2026-45659 took months to move from a quiet patch to a confirmed ransomware tool. This one moved from proof-of-concept to honeypot hits in a single day, publish Tuesday, hit by Wednesday.
