a researcher posted SharePoint exploit code on Tuesday. attackers were forging admin access by Thursday

Microsoft patched CVE-2026-55040 on July 14, folded quietly into that month's Patch Tuesday batch. It sat mostly ignored for four weeks. Then on August 11, security firm Rapid7 published a full technical writeup and a working Python proof-of-concept — and within 48 hours, real attackers were using it to forge admin access on unpatched SharePoint servers.

How attackers skip the login screen entirely

This isn't a stolen-password story. CVE-2026-55040 chains several separate weaknesses in how on-premises SharePoint validates JSON Web Tokens, and the end result is an attacker who never had credentials being treated as a real, known user. All they need is that user's Active Directory SID or UPN — both of which are routinely guessable or discoverable from a company's own public-facing directory or Outlook autodiscover setup.

Rapid7's proof-of-concept doesn't stop at proving the bug exists. It's built to be useful to an attacker: the script forges the token, then automatically queries the target's own domain controller to enumerate users by SID and locate a site administrator to impersonate. Once impersonating that admin, the attacker can read and modify SharePoint content as them — and in observed attacks, this bypass has been chained with a separate remote-code-execution flaw for full, unauthenticated compromise of the server itself.

Weaponized in under 48 hours

KEV Intelligence, which tracks confirmed exploitation attempts, logged 12 total hits against CVE-2026-55040 going back to mid-July — a handful of early, quiet probes before the technical detail was public. Then the PoC dropped on August 11, and 8 of those 12 attempts landed in the 48 hours that followed, on August 12 and 13 alone. That's not a coincidence; that's a proof-of-concept doing exactly what it was designed to demonstrate, just in the wrong hands.

Are you actually exposed

• You're only at risk if you run SharePoint on-premises (Enterprise Server 2016, Server 2019, or Subscription Edition) — SharePoint Online in Microsoft 365 isn't affected.
• Check your build number against the patched versions above; anything older is vulnerable.
• If you can't patch immediately, pull the server off the open internet or gate access behind VPN and MFA until you can.
• Check IIS and SharePoint ULS logs for unusual JWT-bearing requests or unexpected user-impersonation events from August 11 onward — that's when public exploitation began.

This is also the third SharePoint-flavored security story this quarter, after an AI-assisted exploit chain against the platform surfaced weeks earlier. It fits a pattern that's shown up across Citrix's own SAML auth bypass and Exchange's Pwn2Own mailbox takeover: enterprise authentication pipelines, not endpoints, are 2026's softest target.

Shadowserver's count of 8,500+ still-exposed servers means this isn't close to over. If patching hasn't happened yet, do it before reading the next headline about it — the four weeks of quiet between the fix and the first mass exploitation wave is exactly the kind of grace period that doesn't repeat.