Microsoft SharePoint is under attack again. In the current wave, attackers are abusing a critical flaw that lets them bypass authentication and gain administrative access. Thousands of servers are potentially exposed. The relevant security updates have been available since July.
The vulnerability is tracked as CVE-2026-55040 and carries a CVSS score of 9.1, putting it in critical territory. The root cause sits in the JWT validation pipeline. Anyone exploiting it skips the login entirely and can then read or manipulate data. According to published analysis, a successful attack allows actions as a site user or as an administrator.
From proof of concept to attack in a single day
The timeline is a lesson in how little room there is between disclosure and exploitation. On 11 August, security researchers at Rapid7 published an analysis together with a proof-of-concept exploit. One day later, researchers at Defused were already recording attacks against their honeypot systems. Attackers are helping themselves to the published code rather than doing their own work.
Microsoft's advisory carried no note about the ongoing attacks as of this writing. The absence of that note says nothing about the actual situation. Back in July the company already rated exploitation as more likely than not, partly because of the low attack complexity it had itself assigned to the flaw.
Who is affected
Microsoft SharePoint Server 2016, 2019 and the Subscription Edition are considered vulnerable. Updates closing CVE-2026-55040 have been available for all three since the July patch day.
Scans by the Shadowserver Foundation count roughly 8,500 SharePoint servers reachable over the internet worldwide. How many of those have been patched cannot be determined from outside. Based on how earlier SharePoint waves played out, it is safe to assume a noticeable share is still open.
What to do
Make sure your SharePoint servers have at least the July updates applied. Better still, go straight to the August set, which closes another 30 vulnerabilities in SharePoint.
And because only a single day separated the public PoC from the first attacks, check your logs afterwards. Unusual authentication events, new accounts with far-reaching permissions and unexpected access to site content are the traces worth hunting for. A server that sat unpatched on the network since July needs an investigation, not just an update.