CVE-2026-55040Active Exploitation(microsoft / sharepoint_server)

CRITICALCVSS 9.1 · CRITICALCISA KEV

Exploitation observed; activity peaked at 47 mentions and remains active

Immediate actions

Patch microsoft sharepoint_server systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

microsoft CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-08-21. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Patch / fix

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040

Exploit / PoC references

Other references

https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/

Weakness type (CWE)

CWE-1390

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

sharepoint_server

Threat summary

Active exploitation appears in 99 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
205 mentions across 28 observed days

What's happening

Active exploitation reported across 99 signals
Exploit tool or code specified in 26 signals
PoC mentioned or linked in 105 signals
Patch or workaround mentioned in 83 signals
Technical details provided in 159 signals
Disclosure: 33 classified signals
Peaked 20d ago at 47 mentions (2026-08-13); latest day: 1
205 total mentions across 28 days

Affected systems

Vendors

microsoft

Products

sharepoint_server

2 versions affected across 1 product

Deep dive

Activity timeline205 mentions / 28d

Signal classification7 categories

Active Exploitation

9647.3%

Disclosure

3316.3%

Patch

2411.8%

PoC

2411.8%

General

199.4%

Exploit

63.0%

Referenced assets140 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-14	9	Disclosure5Patch4
2026-07-15	6	Active Exploitation1Disclosure1Patch4
2026-07-16	1	Patch1
2026-07-20	1	Active Exploitation1
2026-07-23	1	Disclosure1
2026-08-11	13	Disclosure6General1Patch3PoC3
2026-08-12	30	Active Exploitation12Disclosure6General1Patch2PoC9
2026-08-13	47	Active Exploitation37Disclosure2Exploit1General3Patch2PoC2
2026-08-14	7	Active Exploitation4Patch1PoC2
2026-08-15	3	Active Exploitation1General1PoC1
2026-08-16	2	Active Exploitation1Patch1
2026-08-17	6	Active Exploitation2Disclosure1General1PoC2
2026-08-18	5	Active Exploitation2Disclosure2General1
2026-08-19	18	Active Exploitation9Disclosure1Exploit1General2Patch2PoC3
2026-08-20	8	Active Exploitation5Disclose1Disclosure1Patch1
2026-08-21	5	Active Exploitation3Disclosure1General1
2026-08-24	3	Active Exploitation1Disclosure1Patch1
2026-08-25	10	Active Exploitation4Exploit3General2PoC1
2026-08-26	4	Active Exploitation3Disclosure1
2026-08-27	11	Active Exploitation5Disclosure1Exploit1General3PoC1
2026-08-28	4	Active Exploitation1Disclosure2General1
2026-08-29	2	Active Exploitation1Patch1
2026-08-30	2	Active Exploitation2
2026-09-01	1	General1
2026-09-03	3	Disclosure1General1Patch1
2026-09-14	1	Active Exploitation1

Full discourse20 posts

The Hacker News@TheHackersNews56d
Active Exploitation
🚨 Four Critical Flaws Under Active Exploitation: • macOS CVE-2026-65400 • SharePoint CVE-2026-55040 • vCenter CVE-2026-59310 • Microsoft IKE CVE-2026-33824 Reported attacks include Monero mining, persistent access, and Babuk-derived ransomware. Read: https://thehackernews.com/2026/08/critical-macos-sharepoint-vcenter-and.html
Post summary
Four critical CVEs (CVE-2026-65400, CVE-2026-55040, CVE-2026-59310, CVE-2026-33824) are reported as actively exploited, with attacks involving Monero mining, persistence, and Babuk‑derived ransomware.
49933329452.8K
2.4M followersView on X
Rapid7@rapid792d
Disclosure
In conducting a 0-day research project against #SharePoint, Rapid7 Labs discovered 2 new vulns that, when chained together, achieve RCE against a vulnerable server. Today, Rapid7 and Microsoft are disclosing CVE-2026-55040 – the first vuln in this chain: https://r-7.co/4f2HpQO https://t.co/teX8kkZBQz
Post summary
Rapid7 and Microsoft disclosed that two new SharePoint vulnerabilities, including CVE-2026-55040, can be chained to achieve remote code execution, marking a significant 0‑day discovery.
272328110941.3K
125.9K followersView on X
The Hacker News@TheHackersNews62d
Active Exploitation
🛑 Attackers are exploiting a SharePoint authentication bypass. CVE-2026-55040 lets unauthenticated attackers forge JWTs and impersonate any SharePoint site user, including administrators. Eight of 12 recorded exploit attempts occurred on August 12 and 13, after Rapid7 published a PoC. See how the exploit works: https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html
Post summary
SharePoint authentication bypass CVE-2026-55040 is actively exploited in the wild, with Rapid7 providing a PoC; no patch or workaround is mentioned.
126612508759.8K
2.4M followersView on X
Mike Felch (Stay Ready)@ustayready63d
PoC
Unauthenticated SharePoint Auth Bypass PoC disclosed https://github.com/sfewer-r7/CVE-2026-55040
Post summary
A proof‑of‑concept for CVE‑2026‑55040, an unauthenticated SharePoint authentication bypass, has been disclosed with linked code. No active exploitation, patches, or debunking claims are mentioned.
166122411914.0K
17.5K followersView on X
Mr. OS@ksg93rd62d
Exploit
#AppSec 1⃣. ShieldBreak - Windows Defender 0day vulnerability https://git.projectnightcrawler.dev/NightmareEclipse/ShieldBreak/src/branch/main 2⃣. Zoomsday: Zero-click RCE in Zoom, from any meeting participant to any other (CVE-2026-53413) https://a.security/blog/asecurity-zoomsday 3⃣. Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040) https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040 http://www.kismoe.com
Post summary
The tweet lists three CVEs and provides links to repositories or blog posts that contain exploit code or details, indicating functional exploitation tools are available but no patches or active exploitation reports are mentioned.
13511961118.0K
3.4K followersView on X
Stephen Fewer@stephenfewer91d
Disclosure
Earlier this year I built out an unauth RCE chain against SharePoint, we disclosed it to Microsoft in May and today they have patched out the chains auth bypass vuln, CVE-2026-55040. Disclosure details on the @rapid7 blog, full technical details to be published at a later date...
Post summary
Rapid7 disclosed a new unauthenticated RCE chain in SharePoint (CVE-2026-55040), Microsoft has patched the issue, and technical details will be released later.
64411734932.1K
10.0K followersView on X
Khoa Dinh@_l0gg63d
PoC
Blog for CVE-2026-55040, SharePoint Server Subscription Edition improper JWT validation lead to Arbitrary Account Login: https://blog.viettelcybersecurity.com/sharepoint-cve-2026-55040/ !POC is in blog! no need to find SID https://t.co/nI3nONMB6L
Post summary
The blog provides a proof‑of‑concept for CVE‑2026‑55040, detailing an improper JWT validation in SharePoint Server that allows arbitrary account login.
13311587312.5K
2.4K followersView on X
Stephen Fewer@stephenfewer63d
PoC
Today we have published the technical analysis and PoC for CVE-2026-55040, the Microsoft SharePoint authentication bypass we disclosed last month: https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/
Post summary
Rapid7 released a technical analysis and Proof of Concept for Microsoft SharePoint authentication bypass CVE‑2026‑55040, but the post does not indicate active exploitation or mention any patch.
23701134610.5K
10.0K followersView on X
The Hacker News@TheHackersNews63d
Disclosure
🛑 No SharePoint credentials needed to impersonate an admin and run code. Researchers chained two flaws, CVE-2026-55040 and CVE-2026-63520, to go from unauthenticated user impersonation to code execution on the server. Read details here: https://thehackernews.com/2026/08/researchers-disclose-ai-assisted.html
Post summary
Researchers disclosed that two CVEs in SharePoint allow chaining from unauthenticated user impersonation to server‑side code execution without requiring credentials.
23311114034.4K
2.4M followersView on X
Chumy@rm_rf_chumy91d
Patch
This is the auth by pass which I chain with Flow2Shell CVE-2026-47298 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47298 CVE-2026-55040 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040 Look it dup with @stephenfewer and @_l0gg
Post summary
The message references two CVEs and links to Microsoft advisory pages, indicating a focus on vendor patches rather than presenting PoC or exploitation details.
011076407.0K
484 followersView on X
Caitlin Condon@catc0n50d
Disclosure
The @VulnCheckAI Initial Access team has a blog out now on chaining CVE-2026-55040 and CVE-2026-63520 for full auth bypass-to-RCE in Microsoft SharePoint: https://www.vulncheck.com/blog/cve-2026-63520-sharepoint-unsafe-type-rce
Post summary
A blog detailing the chaining of CVE‑2026‑55040 and CVE‑2026‑63520 to achieve authentication bypass leading to remote code execution in Microsoft SharePoint has been published, though no proof‑of‑concept, exploit code, or patch information is included in the tweet.
023157374.9K
3.6K followersView on X
Censys@censysio49d
General
🚨 CVE-2026-55040 + CVE-2026-63520 can be chained to bypass authentication and achieve RCE on Microsoft SharePoint Server. Censys sees 329,000 Internet-facing servers. Read the advisory: https://bit.ly/4zJA1SK #CVE202655040 #CVE202663520 https://t.co/7Yysltrxm6
Post summary
The tweet notes that CVE-2026-55040 and CVE-2026-63520 can be chained to bypass authentication and achieve RCE on Microsoft SharePoint Server, affecting 329,000 internet-facing servers, with a link to an advisory.
021160274.5K
12.7K followersView on X
blackorbird@blackorbird91d
Patch
CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED) https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/ https://t.co/GEBA6XhrQ8
Post summary
The article announces that CVE‑2026‑55040, a JWT token authentication bypass in Microsoft SharePoint, has been fixed, indicating the availability of a patch.
018056244.8K
43.7K followersView on X
Defused@DefusedCyber63d
Active Exploitation
🚨 Attackers are now using the @rapid7 POC for CVE-2026-55040 against our SharePoint honeypots The vulnerability is a Microsoft SharePoint JWT auth bypass for which Rapid7 published a technical writeup and proof-of-concept code yesterday. Track it live 👉 http://console.defusedcyber.com/signup
Post summary
The tweet reports that attackers are actively exploiting the SharePoint JWT bypass (CVE‑2026‑55040) using Rapid7’s PoC against honeypots, confirming real‑world use.
012252198.5K
7.9K followersView on X
st8le̤̤̤̤̤̤̤̤̤̤ss@st8less61d
PoC
Microsoft SharePoint JWT Auth Bypass PoC CVE-2026-55040 | CVSS 9.1 by @stephenfewer // @rapid7 https://github.com/sfewer-r7/CVE-2026-55040
Post summary
A proof‑of‑concept for an authentication bypass in Microsoft SharePoint (CVE-2026-55040) with a high CVSS score of 9.1 is published on GitHub, but no exploits, patches, or active exploitation claims are reported.
010042292.4K
662 followersView on X
Defused@DefusedCyber50d
General
🚨 We're seeing the SharePoint CVE-2026-55040 + CVE-2026-63520 RCE chain probed in our honeypots The JWT bypass (55040) was exercised, followed by heavy admin enumeration and probing of the Business Data Catalog sink behind CVE-2026-63520. No code execution observed yet Chain writeup published yesterday by @VulnCheckAI Full details on Defused Radar 👉 http://console.defusedcyber.com/radar
Post summary
The statement reports honeypot detection of a SharePoint RCE chain (CVE‑2026‑55040 and CVE‑2026‑63520) with no successful exploitation yet, and provides links to a detailed writeup. No exploit code or active attacks are confirmed, and no mitigation guidance is offered.
09148155.8K
7.9K followersView on X
dbugs@ptdbugs63d
PoC
A PoC/exploit has been discovered for vulnerability CVE-2026-55040 Vendor: Microsoft Product: Microsoft SharePoint Enterprise Server 2016 Description: Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. Link: https://github.com/sfewer-r7/cve-2026-55040 #dbugs_vuln
Post summary
A proof‑of‑concept exploit for CVE-2026-55040 has been published, demonstrating weak authentication in Microsoft SharePoint that allows attackers to bypass network security features.
09043212.8K
3.6K followersView on X
Dark Web Intelligence@DailyDarkWeb49d
Exploit
🚨 Microsoft SharePoint Auth Bypass: Underground Actor Shares ~14K Potential Targets A threat actor on an underground forum has published targeting information associated with CVE-2026-55040, a critical Microsoft SharePoint authentication-bypass vulnerability. * CVE-2026-55040 is a critical weak-authentication vulnerability affecting Microsoft Office SharePoint * Microsoft assigns the vulnerability a CVSS 3.1 score of 9.1 (Critical) * Successful exploitation can allow an unauthenticated remote attacker to bypass a SharePoint security feature over the network * Public exploit/PoC material is now available * The underground actor claims a Shodan search identifies approximately 14,000 potentially exposed SharePoint systems * The actor also published a downloadable target list containing IP addresses, ports and hostnames * Some entries shown in the sample appear associated with government, education and commercial infrastructure across multiple countries ⚠️ Important: The ~14,000 figure DOES NOT mean 14,000 SharePoint servers have been successfully exploited or even confirmed vulnerable. It represents systems identified through internet-exposure/vulnerability search data and should be treated as a potential target pool. ⚠️ Analyst Note: The combination of a critical authentication-bypass vulnerability, public exploit material and precompiled target lists significantly lowers the reconnaissance barrier for opportunistic attackers. Organizations operating affected SharePoint infrastructure should prioritize Microsoft's security update and investigate internet-facing SharePoint instances for evidence of attempted exploitation. #DDW #Microsoft #SharePoint #CVE202655040 #Vulnerability #Cybersecurity #ThreatIntelligence
Post summary
An underground actor released a target list for the critical SharePoint authentication‑bypass CVE‑2026‑55040, noting public PoC code and a ~14,000‑system potential pool, and urges applying Microsoft’s patch.
010044118.6K
206.6K followersView on X
FOFA@fofabot55d
Active Exploitation
⚠️⚠️ CVE-2026-55040 (CVSS 9.1): Unauthenticated JWT auth bypass on on-prem Microsoft SharePoint lets attackers impersonate any user, incl. site admins; actively exploited (CISA KEV) since public PoC. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJNaWNyb3NvZnQtU2hhcmVQb2ludCI= 🎯283.8K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="Microsoft-SharePoint" 🔖Refer: https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html #OSINT #FOFA #CyberSecurity #Vulnerability #SharePoint
Post summary
The post announces that CVE-2026-55040, a high‑severity JWT auth bypass in Microsoft SharePoint, is actively exploited in the wild and has a publicly available PoC, with no patch information provided.
013032183.2K
14.8K followersView on X
SoyITPro@SoyITPro61d
Active Exploitation
🚨 Alerta de seguridad en SharePoint 🚨 Un exploit crítico (CVE-2026-55040) para Microsoft SharePoint ya está siendo usado activamente en ataques. El fallo permite bypass de autenticación JWT, dando a atacantes la capacidad de operar como usuarios o administradores sin privilegios previos. 🔒 Detalles clave: 🔹Publicado como PoC por Rapid7, rápidamente weaponizado en ataques reales. 🔹Afecta SharePoint Enterprise Server 2016 y SharePoint Server 2019. 🔹Microsoft lanzó parches en Patch Tuesday de julio 2026.
Post summary
CVE-2026-55040 is a critical Microsoft SharePoint authentication bypass that is actively exploited in the wild, with a PoC from Rapid7 and official patches released in July 2026.
210031102.4K
13.8K followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	microsoft	sharepoint_server	-	-	-
App	microsoft	sharepoint_server	2016	-	-
App	microsoft	sharepoint_server	2019	-	-

Explore more

Back to dashboard microsoft CVEs sharepoint_server vulnerabilities

What researchers are saying

CVE-2026-55040

Mike Felch (Stay Ready)[verified]@ustayreadyPoC

A proof‑of‑concept for CVE‑2026‑55040, an unauthenticated SharePoint authentication bypass, has been disclosed with linked code. No active exploitation, patches, or debunking claims are mentioned.

Stephen Fewer[verified]@stephenfewerDisclosure

Rapid7 disclosed a new unauthenticated RCE chain in SharePoint (CVE-2026-55040), Microsoft has patched the issue, and technical details will be released later.

Stephen Fewer[verified]@stephenfewerPoC

Rapid7 released a technical analysis and Proof of Concept for Microsoft SharePoint authentication bypass CVE‑2026‑55040, but the post does not indicate active exploitation or mention any patch.

Censys[verified]@censysioGeneral

The tweet notes that CVE-2026-55040 and CVE-2026-63520 can be chained to bypass authentication and achieve RCE on Microsoft SharePoint Server, affecting 329,000 internet-facing servers, with a link to an advisory.

blackorbird[verified]@blackorbirdPatch

The article announces that CVE‑2026‑55040, a JWT token authentication bypass in Microsoft SharePoint, has been fixed, indicating the availability of a patch.

st8le̤̤̤̤̤̤̤̤̤̤ss[verified]@st8lessPoC

A proof‑of‑concept for an authentication bypass in Microsoft SharePoint (CVE-2026-55040) with a high CVSS score of 9.1 is published on GitHub, but no exploits, patches, or active exploitation claims are reported.

dbugs[verified]@ptdbugsPoC

A proof‑of‑concept exploit for CVE-2026-55040 has been published, demonstrating weak authentication in Microsoft SharePoint that allows attackers to bypass network security features.

Dark Web Intelligence[verified]@DailyDarkWebExploit

An underground actor released a target list for the critical SharePoint authentication‑bypass CVE‑2026‑55040, noting public PoC code and a ~14,000‑system potential pool, and urges applying Microsoft’s patch.