SharePoint authentication bypass exploited after public proof of concept

Attackers began exploiting CVE-2026-55040, a CVSS 9.1 authentication bypass in on-premises Microsoft SharePoint Server, within days of Rapid7 releasing a public proof of concept on August 12, 2026, Security Affairs reported on August 13. The flaw in SharePoint's token validation lets an unauthenticated attacker forge a token and impersonate any user, including administrators. Microsoft fixed it in July 2026 Patch Tuesday. CISA added it to its Known Exploited Vulnerabilities catalog on August 18, and on September 25 added another SharePoint flaw, CVE-2026-65660, a code injection vulnerability.

SharePoint servers often hold contracts, HR files and project documents. Administrator access means an attacker can read and change that data, and Security Affairs notes it could provide a foothold toward broader Microsoft 365 infrastructure. The public exploit code lowers the skill needed to attack unpatched servers.

If you run SharePoint Server on-premises, confirm the July 2026 update is installed on every farm, then confirm the fix for CVE-2026-65660 as well. Ask your IT provider whether SharePoint is reachable from the internet and, if so, whether it needs to be. Review recent administrator activity and access logs for sign-ins that don't match known users.

Organizations using SharePoint Online through Microsoft 365 are not running these servers themselves, but hybrid setups that still keep an on-premises farm should be checked. If you are maintaining an on-premises farm mainly out of habit, it is worth comparing the patching workload against a move to the hosted service.