Attackers are exploiting Microsoft SharePoint CVE-2026-55040 after Rapid7 published proof-of-concept code, turning a July 2026 patch-era auth bypass into live abuse against unpatched servers. Telemetry cited by reporters showed 12 exploitation attempts since July 19, with most of them on August 12 and 13.
The flaw is in SharePoint’s JWT, or JSON Web Token, validation path: a forged token can be accepted as if it were real, so the server skips normal login checks and treats the attacker as an existing user or administrator. Microsoft said that can expose files and allow data modification, even if the system stays up.
For teams running exposed SharePoint, the map is identity and content integrity, not just server hardening: if an attacker can impersonate a site account, the lasting exposure is whatever that account can read or change before the compromise is found.