A critical flaw in Microsoft SharePoint is being actively exploited by attackers, even though Microsoft shipped a fix for it more than a month ago. The lesson here is a familiar one in security: a patch that never gets installed does not protect anyone.
The vulnerability, tracked as CVE-2026-55040, carries a severity score of 9.1 out of 10, which puts it in the critical category. It allows an attacker to bypass SharePoint’s authentication system entirely and impersonate a legitimate user, including administrators. Once impersonated, an attacker could view files they should not have access to and, in some cases, modify data. Microsoft’s own advisory notes that the flaw does not appear to affect system availability, so it is not the kind of bug that would take a server offline. It is instead the quieter and arguably more dangerous kind: one that lets someone walk in the front door disguised as someone who belongs there.
How the attack actually works
SharePoint uses small pieces of data called JSON Web Tokens, or JWTs, to confirm that a user really is who they claim to be each time they interact with the system. Security firm Rapid7 found that the code responsible for checking these tokens, specifically two components called SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2, had four separate weaknesses that could be chained together. Combined, those weaknesses let an attacker forge a token that SharePoint accepts as valid, without ever needing a real password or login.
Rapid7 published a proof-of-concept exploit along with its technical writeup, which is common practice meant to push organizations toward patching quickly. In this case, it appears to have also given attackers a blueprint. According to telemetry Rapid7 shared, only a handful of exploitation attempts, twelve in total, have been recorded since July 19. Most of those, eight attempts, happened in just two days, August 12 and 13, right after the proof-of-concept went public. The attempts came from eight different IP addresses spread across Hong Kong, Japan, the Netherlands, Taiwan, and the United States, suggesting more than one group is testing the waters rather than a single coordinated campaign.
What organizations should do
Microsoft actually patched this vulnerability back in its July 2026 Patch Tuesday release, weeks before the current wave of exploitation began. That makes the fix straightforward for any organization that has kept up with its update schedule: confirm the July patch is installed on every SharePoint server, on-premises deployments in particular, since those are typically slower to update than cloud-hosted instances.
Organizations that have not yet applied the update should treat this as urgent. Given the small but rising number of real-world attempts, and the fact that a working exploit is now public, unpatched servers are a realistic target rather than a theoretical one. It is also worth reviewing SharePoint access logs for unusual authentication activity in case an attacker already got in before the patch was applied.
Source: The Hacker News, August 13, 2026, based on research from Rapid7.
