On August 12, honeypots run by the threat intelligence outfit Defused started recording attempts to break into Microsoft SharePoint servers with an exploit that had been public for barely a day. The code was Rapid7's own, published on August 11 alongside a technical analysis of a flaw Microsoft had already fixed.
The flaw is CVE-2026-55040, an authentication bypass in on-premises SharePoint. It lets an unauthenticated attacker forge a login token and act as any user on a site, including a site administrator, with no password and no session cookie. Microsoft shipped the patch on July 14, so this is not a scramble to fix something new. It is a race against everyone who has not applied a month-old update. SharePoint Online is not affected. The exposure sits in SharePoint Server Subscription Edition, SharePoint Server 2019 and SharePoint Enterprise Server 2016.
One header, four broken checks
SharePoint accepts JSON Web Tokens, or JWTs, which are short signed blobs that assert who the bearer is. Rapid7's Stephen Fewer found four weaknesses in the way SharePoint validates them, and they chain together. An attacker can present a token whose header declares "alg: none", meaning it claims to need no signature check at all, point the token's x5t field at SharePoint's own security token service certificate, slip past a check that never properly establishes whether that certificate should be trusted for the job, and attach a signature that is present but cryptographically invalid. Each step hands the next one something that looks acceptable, and the server ends up treating the token as genuine.
What a forged administrator buys
Rapid7's proof of concept does not stop at getting in. It uses the forged token to query the domain controller, enumerate accounts through their security identifiers, pick out the SharePoint administrator and impersonate that account, which is enough to read documents and alter data. The sharper risk is the pairing. Rapid7 also disclosed CVE-2026-63520, a separate remote code execution flaw, and chaining the two carries an attacker from an unauthenticated request all the way to code running on the server. We covered the second half of that chain when it landed, and the original bypass disclosure in July. An advisory from Rewterz on the current attacks names that chaining as the main escalation route.
Apply the July and August updates, then hunt
Fixing this means the July 2026 SharePoint updates for CVE-2026-55040 and the August 2026 updates for CVE-2026-63520, internet-facing servers first. After that, take SharePoint off the public internet if it does not need to be there, restrict access to administrative interfaces, and look backwards through the logs: unusual service-to-service token activity, bursts of failed authentication, and administrative logins nobody can account for. Neither Rapid7's write-up nor the exploitation advisory publishes a CVSS score for either flaw, and there are no file hashes or addresses to block, so authentication telemetry is the whole detection surface here.
Rapid7 held its technical detail for nearly a month after Microsoft's July fix. The attacks arrived the day after that detail went out. Servers on the July patch never had to care.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.