On-premises Microsoft SharePoint servers that missed the July 2026 Patch Tuesday are now live targets. Attackers started exploiting CVE-2026-55040, a CVSS 9.1 authentication bypass, within hours of Rapid7 publishing a proof-of-concept script on August 11. Threat intelligence firm Defused reported on August 12 that its honeypots recorded exploitation attempts leveraging that exact PoC code. If you run SharePoint Server on-premises and have not patched since July, an unauthenticated attacker can bypass authentication on your server and operate as any site user or administrator whose identity they can enumerate.
CVE-2026-55040 is a critical SharePoint authentication bypass patched in July 2026 that is now under active exploitation. The flaw sits in the JWT token validation pipeline and lets a remote, unauthenticated attacker impersonate any SharePoint user or admin whose Active Directory identity they can guess or enumerate.
This is the fifth SharePoint vulnerability exploited this summer, joining CVE-2026-50522, CVE-2026-58644, CVE-2026-56164, and CVE-2026-45659, the last of which put SharePoint shops on a three-day patch clock that we tracked here. SharePoint on-premises is having a brutal season, and the patch debt is compounding.
What is CVE-2026-55040 and how does the exploit chain work?
The vulnerability stems from several issues in SharePoint's JWT token validation pipeline. A remote, unauthenticated attacker who knows a target user's Active Directory Security ID (SID) or User Principal Name (UPN) can craft requests that bypass authentication entirely and assume that user's identity. If the target account has site administrator privileges, the attacker inherits full control of the SharePoint site. Rapid7's disclosure classifies the weakness as CWE-1390, a category of authentication flaws where validation logic accepts tokens it should reject.
The bypass alone gives an attacker authenticated access to SharePoint site functionality. What makes it worse is that Rapid7 chained this authentication bypass with a separate remote code execution vulnerability, tracked as CVE-2026-63520, to achieve unauthenticated RCE against a vulnerable SharePoint server. The RCE component is being patched in the August 11, 2026 Patch Tuesday, according to The Cyber Signal. An environment current on both July and August updates has the full chain closed. One that skipped July still carries the authentication bypass, which means the August RCE patch alone does not save you.
Patching CVE-2026-55040 breaks the chain even before the RCE fix lands, because the attacker needs the bypass to reach the authenticated attack surface where the RCE lives. That detail matters for prioritization: if you can only do one thing this week, apply the July patch.
Microsoft confirmed the findings on May 20, 2026, and indicated the exploit chain would be patched across two scheduled update cycles, the authentication bypass in July and the RCE component in August. The July 14 Patch Tuesday shipped fixes for three affected versions:
- SharePoint Server Subscription Edition: version 16.0.19725.20434 (KB5002882)
- SharePoint Server 2019: version 16.0.10417.20175 (KB5002883)
- SharePoint Enterprise Server 2016: version 16.0.5561.1001 (KB5002891)
How fast did attackers weaponize the PoC?
Less than 24 hours. Rapid7 published technical details and a proof-of-concept script on August 11. By August 12, Defused honeypots were already recording exploitation attempts using that PoC code. The gap between public PoC and active exploitation collapsed to a single day.
Microsoft's advisory still does not mention exploitation, but as the NCIJ Network noted, the tech giant often updates advisories days after attacks are confirmed by third parties. CISA warned that CVE-2026-55040 could be exploited in the wild but has not yet added it to its Known Exploited Vulnerabilities catalog, which already includes over a dozen SharePoint flaws. CISA's KEV catalog has not caught up to the honeypot data. The risk is already real.
The Canadian Centre for Cyber Security went further than Microsoft or CISA. In alert AL26-017, the agency recommended that organizations identify all on-premises SharePoint Server instances, particularly those exposed to the internet, apply the latest security updates, and restrict or eliminate direct internet exposure. The alert also flagged Microsoft's confirmation that CVE-2026-56164, a related SharePoint vulnerability patched in the same July cycle, is being actively exploited.
The broader pattern is clear: SharePoint on-premises is a high-value target, and five separate CVEs have moved from patched to exploited in a single summer. If you operate SharePoint Server exposed to the internet, you are running in a threat environment where the time between patch and weaponization is measured in days.
How did an AI agent help find this chain?
The method Rapid7 used to find this chain deserves as much attention as the vulnerability itself.
Rapid7 Labs conducted a zero-day research project against Microsoft SharePoint in two sprints, one in January 2026 and one in March. The January sprint failed, producing no usable findings. The March sprint succeeded, yielding a two-vulnerability exploit chain that achieved unauthenticated RCE. A significant portion of the work was done by an AI agent. Over 24 active days of agentic work, Rapid7 reported using 96 sessions, issuing 256 prompts, and generating approximately 80,000 agentic tool calls to navigate and reason across a massive codebase.
That matters for you as an operator because it shrinks the gap between patch availability and weaponized exploitation. If AI-assisted vulnerability research can surface an unauthenticated RCE chain in a product as complex as SharePoint Server, the window you have to patch before someone builds a working exploit is shorter than it was last year. The traditional assumption that critical CVEs give you weeks before exploitation is becoming a luxury.
This connects to a pattern we have been tracking. AI agents are now finding vulnerabilities and building malware in ways that compress the timeline for defenders. The SharePoint chain is a concrete data point: a single firm, using an agent, found an exploit chain that would have taken a traditional research team substantially longer to surface.
Rapid7 says it will publish full technical details for the RCE component within 30 days of disclosure. That keeps a complete public exploit chain off the table for now, but plan for that window to close. When the RCE details drop, any unpatched server becomes a one-click target.
What should on-prem SharePoint operators do right now?
Start with inventory. You cannot patch what you do not know exists. Find every on-premises SharePoint Server instance, especially those exposed to the internet, and record its version number against the fixed versions listed above.
Then follow this prioritized sequence:
- Patch internet-facing SharePoint first. An unauthenticated chain matters most where the server is reachable without a foothold. Externally exposed instances should be patched and verified before anything else.
- Confirm patch level against both July and August updates. An environment current on both has the full chain closed. One that skipped July still carries the authentication bypass. If you only applied August, you are still vulnerable to the bypass.
- Review JWT token audit logs going back to July 14, 2026. The bypass has had a public CVE since mid-July, so look for anomalous token activity, unexpected administrator-level actions, or requests that succeeded without proper authentication headers.
- Monitor for indicators of compromise. The Canadian Centre for Cyber Security recommends watching for unexpected privilege escalation, unauthorized authentication attempts, suspicious IIS machine key access, evidence of deserialization attacks, and web shell deployment. Machine key theft is a known SharePoint RCE technique that persists even after patching, so check for stolen keys if you find any sign of compromise.
- Enable AMSI integration for SharePoint web applications. Configure the Antimalware Scan Interface Request Body Scan Mode to Full Mode where operationally feasible. This gives Defender and AMSI detections a chance to catch exploitation activity in progress.
- Rotate credentials for any SharePoint administrator accounts. If logs show suspicious activity dating back to mid-July, treat those credentials as compromised. Rotate service accounts, machine keys, and any stored credentials the SharePoint server can access.
- Restrict or eliminate direct internet exposure. Put SharePoint behind a VPN, reverse proxy, or zero-trust access layer. SharePoint Server was not designed to face the public internet, and five exploited CVEs in one summer prove the point.
The patch-to-weaponization window is closing
Twenty-nine days passed between Microsoft's July 14 patch and the August 11 PoC release. One more day passed before exploitation appeared in honeypots. For defenders, that is the entire operational window: patch within a month or face active exploitation. AI-assisted vulnerability research will compress that further.
SharePoint on-premises is carrying serious risk. If your organization can move to SharePoint Online or Microsoft 365, the patch burden shifts to Microsoft entirely. If you must run on-premises, treat every SharePoint Patch Tuesday as a 72-hour deadline, not a monthly chore. The attackers are already moving faster than your patch calendar.
Sources
- Rapid7 - CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)
- NCIJ Network - SharePoint Vulnerability Exploited Shortly After PoC Release
- Canadian Centre for Cyber Security - AL26-017: Critical vulnerabilities impacting Microsoft SharePoint Server
- The Cyber Signal - Rapid7 Chains Two SharePoint CVEs to Unauthenticated RCE
- OffSeq Threat Radar - Hackers leverage new Microsoft SharePoint exploit in attacks
