New Microsoft SharePoint Exploit

Overview

A newly disclosed Microsoft SharePoint vulnerability (CVE‑2026‑55040) is already being weaponized in attacks, just days after a proof‑of‑concept (PoC) exploit was published by Rapid7. The flaw, an authentication bypass in the JWT token validation pipeline, allows attackers without privileges to impersonate SharePoint users or administrators, enabling unauthorized file disclosure and data modification.

Vulnerability Details

• CVE‑2026‑55040: Critical authentication bypass (CVSS 9.8).
• Impact: Attackers can impersonate users/admins, disclose files, and modify data. Availability of the system is not directly affected.
• Affected versions: SharePoint Enterprise Server 2016 and SharePoint Server 2019.
• Patch release: July 2026 Patch Tuesday.

Exploitation in the Wild

• Rapid7 PoC release: Security researcher Stephen Fewer published a detailed technical write‑up and exploit code.
• Defused honeypots: Reported active exploitation attempts using Rapid7’s PoC against SharePoint honeypots.
• Shadowserver data: Over 8,500 SharePoint servers currently exposed online, though patch status remains unclear.

Security Agency Warnings

• CISA advisory (July 15, 2026):
  • Avoid exposing SharePoint servers directly to the Internet.
  • Block external access to Central Administration.
  • Restrict farm and database communication to required systems.
  • Place servers behind a Layer 7 reverse proxy or similar application‑layer security control.
• Since November 2021, 14 SharePoint vulnerabilities have been flagged as actively exploited, with 8 linked to ransomware campaigns.

Related Exploits

• CVE‑2026‑45659: A high‑severity SharePoint remote code execution flaw disclosed in July 2026 is now confirmed to be exploited by ransomware gangs.
• CVE‑2026‑59309: Defused Cyber observed increased scanning activity targeting another critical SharePoint auth bypass vulnerability.

Defensive Guidance

Organizations should:

• Patch immediately: Apply Microsoft’s July 2026 updates.
• Harden SharePoint servers: Follow Microsoft’s official security‑hardening guidance.
• Monitor for exploitation: Watch for suspicious impersonation attempts and unauthorized file access.
• Restrict exposure: Keep SharePoint servers off the public Internet unless absolutely necessary.

Expert in the Cloud Insight

The rapid weaponization of CVE‑2026‑55040 highlights the shrinking window between disclosure and exploitation. With thousands of SharePoint servers exposed online, attackers are quick to leverage PoC code for real‑world intrusions. For defenders, the lesson is clear: patch velocity and layered defenses are critical. SharePoint remains a high‑value target, and organizations must treat authentication bypass flaws as urgent priorities.