CVE-2026-55040: Active SharePoint Exploitation Within 48 Hours…

Attackers are already exploiting CVE-2026-55040, a critical JWT authentication bypass in Microsoft SharePoint Server. The window between proof-of-concept publication and in-the-wild exploitation has collapsed to just two days.

Attackers began exploiting CVE-2026-55040, a critical authentication vulnerability in Microsoft SharePoint Server, within 48 hours of Rapid7 publishing a proof-of-concept on August 11, 2026. The Cybersecurity and Infrastructure Security Agency confirmed in-the-wild exploitation by adding the flaw to its Known Exploited Vulnerabilities catalog on August 18, 2026, triggering remediation deadlines for U.S. federal agencies under Binding Operational Directive 26-04.

Key Takeaways

CVE-2026-55040 carries a CVSS 9.1 score and, according to Rapid7, allows an unauthenticated attacker to impersonate any SharePoint user or administrator via a forged JWT.
Rapid7 published technical details and a PoC on August 11, 2026; by August 12–13, honeypots recorded 8 exploitation attempts from 8 IP addresses across 5 countries.
CISA added the vulnerability to the KEV catalog on August 18, 2026. Microsoft MSRC still listed "Exploited: No" at the time of the advisory publication.
Patches have been available since July 14, 2026 for SharePoint Server Subscription Edition (KB5002882), 2019 (KB5002883), and 2016 (KB5002891).

How the JWT Bypass Chain Works in SharePoint

The vulnerability resides in four chained flaws in the JWT token validation pipeline of SharePoint Server Subscription Edition. According to Rapid7's original analysis, the first link is the acceptance of a JWT header with alg:none, which disables signature verification. The second is the resolution of the signing key via the thumbprint of SharePoint's internal STS certificate, without actual validation. The third is the bypass of a non-empty check on a placeholder signature that is never verified. The fourth is the impersonation of any site user.

Microsoft confirms exploitation could allow file disclosure and data modification, but does not impact system availability. The source does not specify which data types are actually at risk or whether exploitation has led to access to sensitive information in production environments. The CVSS 9.1 score reflects the severity of a bypass that requires no credentials or user interaction.

From Patch to Exploitation: The Timeline Shrinks

Microsoft released the patch on July 14, 2026 during Patch Tuesday. Rapid7 published technical details and a PoC on August 11, following a coordinated disclosure period. Attack timeline data comes from a single structured source, Rapid7, supplemented by honeypot observations reported by SecurityAffairs.

According to SecurityAffairs, citing KEVIntel data, 12 exploitation attempts were recorded from July 19, 2026. Of these, 8 clustered on August 12–13, immediately after the PoC release. The 8 IP addresses involved are distributed across Hong Kong, Japan, the Netherlands, Taiwan, and the United States. Defused researchers observed attackers using Rapid7's PoC directly against their SharePoint honeypots. No source in the dossier documents successful compromises beyond honeypot observations, nor attributes the attacks to specific groups.

"A critical authentication bypass vulnerability exists in SharePoint Server Subscription Edition's JWT token validation pipeline. The root cause is a chain of four distinct weaknesses that, when combined, allow an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user." — Rapid7, Stephen Fewer

The Timing Discrepancy Between Microsoft and CISA

Microsoft MSRC, in its official advisory for CVE-2026-55040, listed the status as "Exploited: No" at the time of publication. CISA added the same vulnerability to the KEV catalog on August 18, 2026, under a criterion that requires evidence of in-the-wild exploitation. Rapid7 noted the subsequent update following the KEV listing. This incongruity — resolved by CISA's update but not yet reflected in the Microsoft advisory at publication time — does not alter the threat severity, but illustrates how attacker speed can outpace official classification systems.

Immediate Actions

Apply patches KB5002882 (Subscription Edition, build 16.0.19725.20434), KB5002883 (2019, build 16.0.10417.20175), or KB5002891 (2016, build 16.0.5561.1001), available since July 14, 2026, to all on-premises SharePoint Server instances exposed to the network.
Ensure SharePoint Server instances are not reachable from the internet without additional access controls, given the remote, unauthenticated nature of the vulnerability.
For U.S. federal organizations: comply with CISA Binding Operational Directive 26-04 remediation deadlines, triggered by the KEV catalog addition.

DeafNews Analysis: The Limits of Coordinated Disclosure

The CVE-2026-55040 case raises questions about coordinated disclosure practices. The standard sequence — private discovery, patch, public disclosure with a protective delay — collides here with a hard fact: attackers replicated the exploit chain in very short order after the PoC publication. The distance between theory and active exploit now measures in days, not weeks.

This does not imply coordinated disclosure failed in this specific case: the patch was available from July 14, nearly a month before the PoC. The relevant element is instead the speed with which attackers adapted public code against unpatched systems. The source does not specify whether the 8 post-PoC attempts represent reconnaissance activity or targeted compromise attempts.

Also unverified: the identity of the operators behind the 8 IP addresses, any potential access to sensitive data in production environments, and the status of the separate RCE vulnerability that Rapid7 chained to the JWT bypass to achieve unauthenticated remote code execution.

Information verified against cited sources and current as of publication.

Sources

Sources and references