SharePoint PoC Goes Live, and Attackers Start Using It Within a Day
A public proof of concept for a Microsoft SharePoint authentication bypass moved from research to hostile scanning in roughly a day. The flaw is patched, but the speed of weaponisation has turned an old deployment gap into an immediate incident-response question.
Update: the bypass now has a route to code execution
Updated 27 August 2026: New research from VulnCheck shows how the authentication bypass in CVE-2026-55040 can be chained with CVE-2026-63520, an unsafe .NET type-instantiation flaw in SharePoint’s Business Data Connectivity components, to reach unauthenticated remote code execution.
VulnCheck developed a working exploit, scanner, packet captures and Snort and Suricata detection rules. The commercial exploit artefacts are restricted, but the published analysis documents the request chain. This is credible PoC availability and a material reduction in attacker effort. It is not, by itself, confirmation that malicious operators have completed the full chain.
Honeypot reporting on 25 August described probing that followed the chain’s early stages, including the authentication bypass, administrator enumeration and tests for the BDC sink. No code execution was observed in that reporting. Defenders should therefore label the activity as observed probing, not confirmed exploitation of CVE-2026-63520.
Versions fixed for CVE-2026-63520
- SharePoint Enterprise Server 2016: update to 16.0.5565.1001 or later.
- SharePoint Server 2019: update to 16.0.10417.20198 or later.
- SharePoint Server Subscription Edition: update to 16.0.19725.20522 or later.
Administrators should verify both fixes across every farm node. Closing only the JWT bypass or only the unsafe-type path leaves an incomplete view of the attack chain. Patching should be paired with review of unusual JWT-backed requests, BDC metadata activity, administrator enumeration and suspicious child processes.
Security researchers have observed attackers using public exploit code for CVE-2026-55040 against SharePoint honeypots. Rapid7 published its technical analysis and proof of concept on 11 August; exploitation attempts were reported the following day.
The vulnerability affects the JSON Web Token validation path in on-premises Microsoft SharePoint. An unauthenticated attacker can bypass identity checks and impersonate a SharePoint site user or administrator. Microsoft says successful exploitation can expose files and allow data modification, although the flaw does not directly affect service availability.
What CVE-2026-55040 does
SharePoint uses signed JWTs to represent identity and authorisation in several application flows. CVE-2026-55040 weakens that trust decision. Instead of first stealing a legitimate administrator account, an attacker can construct a request that passes through the vulnerable validation logic and is treated as an authenticated SharePoint identity.
That makes the flaw more than a simple login bypass. SharePoint commonly contains internal documents, operational records and business workflows. Administrative impersonation may also give an attacker the access needed to change site data, create persistence or combine the bypass with another weakness.
Microsoft patched CVE-2026-55040 in the July 2026 security updates for SharePoint Enterprise Server 2016 and SharePoint Server 2019. The appearance of working exploit code does not create the vulnerability, but it removes much of the attacker’s research cost. What previously required reverse engineering can now be reproduced, adapted and scanned at scale.
Thousands of servers remain reachable
Shadowserver was tracking more than 8,500 Internet-exposed Microsoft SharePoint servers when the new attacks were reported. That number does not reveal how many are vulnerable: some are patched, some may be honeypots and version detection from the Internet is imperfect. It does show that attackers still have a large pool of reachable systems to test.
Direct Internet exposure matters because an authentication bypass removes the control administrators normally expect to protect a site. A vulnerable server behind a login page is still vulnerable. Network placement, reverse proxies and strict access paths become important compensating controls while patch status is verified.
Do not confuse this with the ransomware flaw
CVE-2026-55040 is not the only active SharePoint problem. CISA has separately confirmed that CVE-2026-45659, a SharePoint remote-code-execution vulnerability already known to be exploited, is now being used in ransomware attacks.
The distinction matters during triage. CVE-2026-55040 is the newly weaponised JWT authentication bypass discussed here. CVE-2026-45659 is a separate RCE flaw with confirmed ransomware use. A server may require remediation and investigation for both; applying one update should not be treated as evidence that the wider SharePoint attack surface is safe.
How administrators should respond
- Confirm the exact SharePoint build. Inventory every farm, including disaster-recovery, test and isolated systems that may not appear in the main patch platform.
- Apply the applicable Microsoft security updates. Verify installation on each SharePoint node and complete any required restart or configuration step.
- Reduce exposure. Avoid publishing SharePoint directly to the Internet unless there is a documented requirement. Place required access behind a Layer 7 reverse proxy or equivalent application control.
- Protect administration paths. Block external access to SharePoint Central Administration and restrict farm and database communications to expected systems.
- Review logs for pre-patch activity. Look for unusual JWT-backed requests, unexpected administrative actions, file access, configuration changes and persistence around the period before remediation.
- Assume patching and hunting are separate tasks. An update closes the vulnerable code path; it does not remove an attacker who already used it.
Defenders should also compare Internet-facing inventory with asset ownership. Forgotten SharePoint servers are particularly dangerous because they may remain reachable while receiving neither updates nor central logging. A server that cannot be assigned to a responsible team should be isolated until its purpose and security state are understood.
The practical lesson
The important signal is not simply that proof-of-concept code exists. It is the compressed timeline between disclosure and observed use. Public technical material now moves into scanning infrastructure fast enough that a normal weekly or monthly remediation queue may be too slow for exposed enterprise software.
For CVE-2026-55040, the response is straightforward: patch, reduce exposure, verify every node and investigate whether the server was touched before the fix. The separate ransomware use of CVE-2026-45659 makes that broader review even more urgent.
Sources and further reading
- BleepingComputer: Hackers leverage new Microsoft SharePoint exploit in attacks
- Rapid7: Microsoft SharePoint JWT Token Authentication Bypass Technical Analysis
- Microsoft Security Response Center: CVE-2026-55040
- VulnCheck: SharePoint unsafe-type RCE chain analysis for CVE-2026-63520
- Microsoft Security Response Center: SharePoint Business Connectivity Services remote-code-execution advisory
- Defused: Honeypot observations of SharePoint authentication-bypass and RCE-chain probing, reported 25 August 2026.
- BleepingComputer: Hackers target Microsoft SharePoint RCE chain with PoC exploit, published 26 August 2026 at 10:47 AM; timezone not stated.
