Full research report

Hackers leverage new Microsoft SharePoint exploit in attacks

Original reporting ↗
★ Threat intelligence assessment medium confidence

Executive assessment

The strongest evidence establishes CVE-2026-55040 as a critical unauthenticated authentication bypass in on-premises SharePoint Server, with public code released by Rapid7 on 11 August 2026. Rapid7's analysis shows that the outcome arises from several interacting JWT-validation failures and can permit impersonation of a site user or administrator, creating direct confidentiality and integrity risk. Reporting of attempts against honeypots is consistent with rapid adoption of public exploit code, but it does not by itself demonstrate successful compromise of production systems. CVE-2026-45659 belongs in the story as concurrent SharePoint risk context: it is a distinct authenticated deserialisation flaw for which exploitation is officially confirmed by CISA.

What happened

Microsoft and Rapid7 disclosed CVE-2026-55040 on 14 July 2026, and Microsoft addressed it in the July 2026 security updates. Rapid7 published detailed analysis and public proof-of-concept code on 11 August; subsequent reporting on 12 August said matching attempts were already reaching SharePoint honeypots. CVE-2026-45659 is a separate SharePoint code-execution flaw that CISA had added to its Known Exploited Vulnerabilities catalogue on 1 July, rather than the vulnerability exercised by the new PoC.

Affected scope

CVE-2026-55040 affects on-premises SharePoint Server 2016 Enterprise, SharePoint Server 2019 and SharePoint Server Subscription Edition; NVD identifies Subscription Edition builds earlier than 16.0.19725.20434 as vulnerable. Internet-facing deployments present the clearest exposure, while SharePoint Online is not identified in the verified affected configurations.

Technical assessment

CVE-2026-55040 combines several weaknesses in SharePoint's service-to-service JSON Web Token validation. An unauthenticated network attacker can present a forged token that the vulnerable validation logic accepts, allowing impersonation of a SharePoint site user or administrator and consequent file disclosure or data modification; published evidence does not attribute an availability impact. This is distinct from CVE-2026-45659, where an already authorised attacker can trigger unsafe deserialisation to execute code remotely.

Recommended defensive actions

  1. Apply Microsoft's July 2026 SharePoint security updates to every supported on-premises farm and verify that Subscription Edition is at least build 16.0.19725.20434.
  2. Inventory all Internet-accessible SharePoint Server instances and remove direct exposure wherever it is not operationally required.
  3. Restrict external access to SharePoint Central Administration and limit farm and database communication to explicitly required systems.
  4. Deploy an application-layer reverse proxy or equivalent Layer 7 control in front of SharePoint where external publication remains necessary.
  5. Hunt for anomalous bearer-token authentication, unexpected user or administrator impersonation, unusual SharePoint file access and unauthorised content changes following 11 August 2026.
  6. Review potentially exposed servers for compromise before treating patch installation alone as sufficient remediation.

Uncertainties and evidence gaps

  • The reported CVE-2026-55040 activity was observed against honeypots; successful compromise of production organisations has not been independently established.
  • No actor, malware family or victim organisation has been credibly attributed to the reported CVE-2026-55040 attempts.
  • The number of exposed SharePoint servers that remain vulnerable, rather than merely Internet-visible, is unknown.
  • CVE-2026-45659 exploitation is confirmed separately, but available evidence does not establish that it was chained with CVE-2026-55040 in the reported attempts.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated network access to a vulnerable on-premises SharePoint web service.
ComponentSharePoint service-to-service JSON Web Token parsing and validation boundary.
MechanismMultiple validation weaknesses allow an untrusted token to be accepted as a SharePoint user or administrator identity.
ImpactUnauthorised access to SharePoint data and the ability to disclose or modify files and other content.
DetectionAnomalous bearer-token requests, unexpected site-user or administrator identities, unusual file access, and unexplained SharePoint content or permission changes.
MitigationInstall Microsoft's July 2026 SharePoint updates; for Subscription Edition, verify build 16.0.19725.20434 or later, and restrict unnecessary Internet exposure.
Exploitation status

Public PoC available for CVE-2026-55040; attack attempts against honeypots are credibly reported, but successful compromise is not independently confirmed, while CVE-2026-45659 is separately confirmed as actively exploited.

Research process

The investigation separated the newly published CVE-2026-55040 PoC and reported honeypot activity from the older, separately exploited CVE-2026-45659. Microsoft-linked vulnerability records and NVD establish the affected products and security boundaries, while Rapid7's original analysis confirms the unauthenticated JWT-bypass mechanism and public code release. The evidence supports urgent patching and exposure reduction, but not claims of confirmed production compromise or attribution for CVE-2026-55040.

  1. What exactly did the supplied report claim?
    Opened the supplied BleepingComputer URL to assess the report and its cited evidence.
    bleepingcomputer.com ↗

    The site presented an automated verification page, so the article could not be independently read at that URL during the investigation.

    why The supplied article text remained a lead rather than proof, requiring primary-source corroboration.

  2. Does CVE-2026-55040 exist, and what products and impact are formally recorded?
    Opened the NVD vulnerability record.
    nvd.nist.gov ↗

    NVD records a network-accessible weak-authentication flaw affecting SharePoint Server 2016 Enterprise, 2019 and Subscription Edition, with Subscription Edition versions before 16.0.19725.20434 identified as vulnerable.

    why This confirmed the CVE, affected scope and security impact independently of the news report.

  3. Is CVE-2026-45659 the same exploit described in the headline?
    Opened the NVD record for the second stated CVE.
    nvd.nist.gov ↗

    CVE-2026-45659 is an authenticated deserialisation vulnerability permitting remote code execution and is listed by CISA as known exploited.

    why Its access requirement and mechanism differ from CVE-2026-55040, showing that it is contextual SharePoint exploitation rather than the new PoC's vulnerability.

  4. Is public exploit code actually available for CVE-2026-55040?
    Searched GitHub for repositories matching the CVE and opened the researcher repository.
    github.com ↗

    Stephen Fewer's public repository contains a working proof-of-concept script for the SharePoint JWT authentication bypass and links to Rapid7's analysis.

    why This confirms public PoC availability, but code publication alone does not prove successful exploitation in production.

  5. What is the technical mechanism and disclosure timeline?
    Opened Rapid7's original technical analysis linked from the repository.
    rapid7.com ↗

    Rapid7 states that Microsoft and Rapid7 disclosed the issue on 14 July, published analysis and a PoC on 11 August, and found four interacting weaknesses in SharePoint's JWT validation that permit unauthenticated user impersonation.

    why The original researcher source establishes the mechanism, timeline and exploitation significance without relying on secondary reporting.

  6. Is exploitation of the second SharePoint CVE officially confirmed?
    Opened CISA's filtered Known Exploited Vulnerabilities catalogue entry.
    cisa.gov ↗

    CISA lists CVE-2026-45659 as known exploited, added on 1 July 2026 with a 4 July remediation deadline.

    why This supports confirmed exploitation only for CVE-2026-45659 and prevents that status being incorrectly transferred to CVE-2026-55040.

  7. What hardening measures complement patching?
    Reviewed Microsoft's SharePoint Server security-hardening guidance.
    learn.microsoft.com ↗

    Microsoft recommends role-specific server hardening and firewall separation between SharePoint farm systems and external requests.

    why This provides a vendor-backed basis for reducing exposure in addition to installing the security update.

Named in this story
TargetsInternet-exposed Microsoft SharePoint Server deploymentsSharePoint Server 2016 EnterpriseSharePoint Server 2019SharePoint Server Subscription Edition
Related CVEs CVE-2026-55040CVE-2026-45659

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 7 registered sources supplied useful evidence (2 primary, 4 corroborating, 1 contextual and 0 PoC/exploit references). 54 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok11 records Primary evidence1 matched items Published the source report used to frame and date the event.
CISA KEVkev ok1665 records Primary evidence2 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. Supplied a vendor or government advisory opened and verified during focused research.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
Microsoft Securitynews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
NVDcve ok900 records Corroborating2 matched items Supplied independent analysis opened and verified during focused research.
Rapid7news ok1 records Corroborating1 matched items Supplied independent analysis opened and verified during focused research.
FIRST EPSSepss ok7602 records Context1 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5324 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok682 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1008 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok8 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok12 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok13 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1590 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok6 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok10 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 21 opened outside the registered collection
References & evidence
Vulnerability & exploitation2
CVE-2026-45659 CISA KEV Microsoft SharePoint Server · added 2026-07-01 · used in ransomware CISA catalog ↗
CVE-2026-45659 EPSS 9.1% 95th percentile exploitation probability
Reporting-linked PoC claims1
https://github.com/sfewer-r7/CVE-2026-55040 github.com ↗

Linked by reporting but not validated as PoC by the configured exploit indexes.

PoC & exploit code1
Rapid7 CVE-2026-55040 proof of concept github.com ↗

Public exploit code demonstrates unauthenticated SharePoint JWT authentication bypass.

Vendor & gov advisories3
Microsoft Security Update Guide: CVE-2026-55040 msrc.microsoft.com ↗

Vendor security-update record for the SharePoint authentication bypass.

CISA Known Exploited Vulnerabilities entry for CVE-2026-45659 cisa.gov ↗

Confirms exploitation of the separate SharePoint deserialisation vulnerability and requires vendor mitigations.

Microsoft SharePoint Server security-hardening guidance learn.microsoft.com ↗

Vendor guidance recommends firewall separation and role-specific hardening for SharePoint farms.

Analysis & research3
Rapid7 analysis of CVE-2026-55040 rapid7.com ↗

Original research documents the JWT validation weaknesses and publication of the PoC on 11 August 2026.

NVD record for CVE-2026-55040 nvd.nist.gov ↗

Confirms weak authentication, affected SharePoint editions and the critical network-accessible impact.

NVD record for CVE-2026-45659 nvd.nist.gov ↗

Separates the previously exploited authenticated deserialisation flaw from the new authentication-bypass story.