Rapid7 SharePoint Exploit Reportedly Used Against Honeypots

Summary

Rapid7 published a PoC for SharePoint flaw CVE-2026-55040; Defused reported its use against honeypots, though Microsoft has not flagged it as successfully exploited in the wild. Microsoft patched it, and CISA urged SharePoint hardening.

Key points

CVE-2026-55040 is a SharePoint JWT token validation bypass that can let an unauthenticated attacker impersonate a site user or administrator.
Microsoft says exploitation could disclose files and modify data, but not affect system availability.
Rapid7 published a technical write-up and PoC; Defused reported the code was being used against its SharePoint honeypots.
Microsoft patched the flaw in its July 2026 updates for SharePoint Enterprise Server 2016 and SharePoint Server 2019; Microsoft had not flagged it as successfully exploited in the wild.
CISA advised limiting direct Internet exposure, restricting external access to Central Administration, and limiting farm and database communications.
Shadowserver tracked more than 8,500 SharePoint servers exposed online, but the article says the number already patched or operating as honeypots was unknown.
CISA also said CVE-2026-45659, a separate SharePoint remote-code-execution flaw, was being exploited by ransomware gangs.

Article Details

Vulnerability Types: Authentication bypass
Remote code execution
Severity: Critical
Affected Versions: SharePoint Enterprise Server 2016
SharePoint Server 2019
Exploitation Status: active
Exploit Availability: public_poc
Patch Status: available
Workarounds: Avoid directly exposing SharePoint servers to the Internet unless necessary.
Block external access to SharePoint Central Administration.
Restrict farm and database communication to required systems.
Where Internet exposure is required, place servers behind a Layer 7 reverse proxy or similar application-layer security control.