A SharePoint vulnerability patched last month is now being exploited in the wild, with the attacks starting shortly after the release of a proof-of-concept (PoC) exploit.
The vulnerability, tracked as CVE-2026-55040, was fixed by Microsoft with its July Patch Tuesday updates.
Microsoft described it as a weak authentication issue that allows an attacker to bypass a security feature over a network.
“Exploiting this vulnerability could allow an attacker to disclose files and modify data,” Microsoft said, adding, “In a network-based attack, an unauthenticated attacker could bypass authentication and make an anonymous connection.”
Rapid7 disclosed the technical details of CVE-2026-55040 on August 11, showing how a remote, unauthenticated attacker could exploit it to bypass authentication and perform operations as a SharePoint site user or administrator. The security firm also made a PoC script available.
Threat intelligence firm Defused reported on August 12 that its honeypots have recorded exploitation attempts targeting CVE-2026-55040 and the attacks are leveraging the PoC released by Rapid7.
Microsoft’s advisory still does not mention exploitation, but it’s not uncommon for the tech giant to only update its advisories days after attacks have been confirmed.
Separately, Rapid7 on Tuesday reported discovering CVE-2026-63520, a SharePoint flaw that could be chained with CVE-2026-55040 to achieve unauthenticated remote code execution on servers.
CVE-2026-63520 was addressed by Microsoft with its August Patch Tuesday updates, and there is no indication that it too is being exploited in attacks.
Surge in SharePoint vulnerability exploitation
CISA recently urged organizations to ensure that their SharePoint instances are up to date and protected in light of a new wave of attacks.
At the time, CISA warned that CVE-2026-55040 could also be exploited in the wild. The agency has yet to add the vulnerability to its KEV catalog, which currently includes over a dozen SharePoint flaws.
CVE-2026-55040 is the fifth SharePoint vulnerability whose exploitation has come to light this summer, after CVE-2026-50522, CVE-2026-58644, CVE-2026-56164, and CVE-2026-45659.
However, there does not appear to be any public information on who is behind the exploitation of these weaknesses.
Related: August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day
Related: Fresh Windows Zero-Day Exploited in North Korean Cyberattacks
Related: Zoom Patches Zero-Click Code Execution Vulnerability