SharePoint Flaw Targeted Shortly After PoC Release
Summary
Defused says its honeypots recorded attempts exploiting SharePoint flaw CVE-2026-55040 using Rapid7’s PoC. Microsoft patched it in July; a separate August-patched flaw could enable unauthenticated remote code execution when chained with it.
Key points
- Microsoft patched SharePoint flaw CVE-2026-55040 in its July updates; Microsoft describes it as a weak-authentication issue that could enable authentication bypass and file disclosure or data modification.
- Rapid7 published technical details and a PoC on August 11, describing remote, unauthenticated access that could allow operations as a SharePoint site user or administrator.
- Defused reported on August 12 that its honeypots recorded exploitation attempts leveraging the Rapid7 PoC; this is reported activity, not confirmation of victim compromise.
- Microsoft’s advisory does not mention exploitation, while CISA has warned that CVE-2026-55040 could be exploited in the wild.
- CVE-2026-63520, patched in Microsoft’s August updates, could be chained with CVE-2026-55040 for unauthenticated remote code execution; the article reports no indication that CVE-2026-63520 is being exploited.
- The article says CVE-2026-55040 is the fifth SharePoint flaw reported exploited that summer and that the actors behind the exploitation are not publicly identified.
Article Details
- Vulnerability Types
- Weak authentication
- Authentication bypass
- Remote code execution
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
CVE
CVE-2026-55040The vulnerability, tracked as CVE-2026-55040, was fixed by Microsoft with its July Patch Tuesday updates.CVE-2026-63520Separately, Rapid7 on Tuesday reported discovering CVE-2026-63520, a SharePoint flaw that could be chained with CVE-2026-55040 to achieve unauthenticated remote code execution on servers.