Hackers Mass-Exploit Patched SharePoint Flaw After Public PoC

Attackers have begun actively exploiting a critical Microsoft SharePoint vulnerability, tracked as CVE-2026-55040, less than a month after proof-of-concept exploit code was made public by security research firm Rapid7 according to Help Net Security. The threat intelligence firm Defused confirmed the active exploitation against its SharePoint honeypots in a public warning.

This wave of attacks follows a predictable and dangerous playbook: a critical flaw gets patched, a public proof-of-concept (PoC) lowers the technical barrier for attackers, and exploitation spikes. Despite Microsoft issuing a fix in its July 2026 Patch Tuesday updates, many organizations have not applied the patch, leaving them exposed.

From Research to Attack Code to Active Exploit

The timeline of this event highlights the shrinking window between disclosure and active attacks in the enterprise threat landscape.

• July 2026: Microsoft patches the vulnerability, rating it with a CVSSv3.1 score of 9.1 (Critical).
• August 2026: Rapid7 researcher Stephen Fewer publishes a detailed technical analysis and publicly available proof-of-concept (PoC) exploit code. The code demonstrates how to bypass SharePoint's authentication.
• Within days: Security firm Defused observes the exploit being used in the wild against its honeypots, confirming threat actors have adopted the publicly available tool.

“A remote unauthenticated attacker can leverage CVE-2026-55040 to bypass authentication on a vulnerable SharePoint server, and perform operations as a SharePoint site user or administrator,” Fewer explained.

This underscores a persistent challenge in enterprise IT: the gap between a vendor releasing a patch and an organization deploying it is a primary attack surface. Even with a fix available for weeks, many SharePoint instances remain unprotected. For larger teams managing numerous assets, this gap is often where breaches occur, a challenge highlighted in our analysis of why Security Teams Miss 77% of Critical Attack Techniques.

The Technical Risk: Impersonation Opens the Vault

The danger of CVE-2026-55040 lies in its ability to completely undermine SharePoint’s authentication gatekeeper. Microsoft’s own advisory states the flaw “allows impersonation.”

Here's what that means in practical terms for an organization:

• Mechanism: The vulnerability exists in SharePoint’s JWT token validation pipeline. An attacker can craft a malicious token to impersonate any known user, including an administrator.
• Prerequisite: The attacker must know a target user's identifier, such as their Active Directory Security ID (SID) or User Principal Name (UPN). These can often be discovered through basic enumeration.
• Impact: Once authenticated as another user, the attacker can perform operations as that user. Microsoft notes this allows an attacker to "disclose files and modify data" but does not allow them to impact system availability.

The risk extends beyond a single flaw. Fewer's research at Rapid7 Labs chained this authentication bypass with another, separate vulnerability, CVE-2026-63520, to achieve unauthenticated remote code execution (RCE). While the RCE component is slated for an August patch, patching CVE-2026-55040 now breaks that entire exploit chain.

This layered attack surface is a core reason why XDR Clash: CrowdStrike, Microsoft, Palo Alto Vie for Market is a critical battleground, as these platforms are built to detect and respond to such multi-stage intrusions.

Patch Now, Detect Activity, Expect Escalation

The immediate path forward is clear, but it requires urgent and decisive action from security and IT teams.

Your first and most critical action is to apply the July 2026 Microsoft updates. The specific Knowledge Base (KB) patches are:

• KB5002882 for SharePoint Server Subscription Edition
• KB5002883 for SharePoint Server 2019
• KB5002891 for SharePoint Enterprise Server 2016

Beyond patching, detection is key. Security teams should immediately hunt for anomalous authentication or file access events on SharePoint servers, particularly those exposed to the internet. Look for signs of the documented SID or UPN enumeration techniques. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) advises "avoid exposing SharePoint Servers directly to the internet unless necessary." If exposure is required, they recommend placing servers behind a Layer 7 reverse proxy with authentication and request inspection.

What to watch for next:

1. Sophistication of attacks: The initial wave likely uses the published PoC directly. Watch for modified, stealthier versions or integration into automated attack toolkits.
2. Chained exploitation: As CVE-2026-63520 remains unpatched until August, attackers may attempt to combine these flaws for RCE, significantly increasing the impact.
3. Targeted data theft: This flaw is a perfect vector for corporate espionage or data extortion. Sensitive internal documents stored on SharePoint are now at elevated risk for organizations that have not patched.

The public release of exploit code turned a patched vulnerability into an active and widespread threat. This incident is a stark reminder that in modern security, the patch cycle is a race. The starting gun is the vendor advisory. The finish line is your last server updated. The attackers are already running.

Impact Analysis

• Organizations running unpatched SharePoint versions are now actively being targeted by attackers exploiting this vulnerability for unauthorized access.
• Attack cycles have accelerated dramatically - public proof-of-concept code was weaponized within days, leaving limited time for patching.
• This breach pattern demonstrates how the gap between patch availability and deployment creates critical security vulnerabilities for enterprises.