A critical Microsoft SharePoint Server flaw (CVE-2026-55040, CVSS 9.1) is drawing exploitation attempts after Rapid7 published proof-of-concept code on August 11, 2026. Discovered by Rapid7 senior principal researcher Stephen Fewer, it lets unauthenticated attackers forge JWT tokens and assume the identity of any SharePoint site user or administrator — no credentials needed.
Microsoft rescored its advisory from medium to critical on the day it shipped the fix. An attacker needs to know the account they're impersonating, but Rapid7's script enumerates Active Directory SIDs to find the site administrator itself. SharePoint Online isn't affected.
Worse, the bypass is half of a chain Rapid7 built for full unauthenticated remote code execution. The other half, CVE-2026-63520 (CVSS 8.1, High), was patched only on August 11, and it also hits Project Server and Office Web Apps Server — Microsoft split the fix across two cycles, so July's update closes the bypass and nothing more.
Exploitation so far is telemetry, not confirmed victims: Defused saw Rapid7's PoC fired at its SharePoint honeypots within a day, and KEVIntel sensors have logged attempts since July 19. Microsoft hasn't confirmed in-the-wild exploitation, and it isn't in CISA's KEV catalog.
Patch both. July's fix is KB5002882 (Subscription Edition, build 16.0.19725.20434), KB5002883 (Server 2019, 16.0.10417.20175) and KB5002891 (Enterprise Server 2016, 16.0.5561.1001); August's updates take those to 16.0.19725.20522, 16.0.10417.20198 and 16.0.5565.1001. If you haven't applied either, time to do it now.
Sources: The Hacker News | Rapid7
