SharePoint CVE-2026-55040 Exploitation Detected 24 Hours After Rapid7 PoC
Public PoC triggered immediate exploitation of SharePoint CVE-2026-55040 within 24 hours. Five SharePoint flaws exploited this summer show a repeatable pattern of rapid weaponization after disclosure. Chaining risk with CVE-2026-63520 remains unaddressed in current KEV listings.
Rapid7 disclosed the weak authentication flaw on August 11, enabling remote unauthenticated attackers to impersonate site users or administrators. Defused telemetry confirmed live exploitation the following day using the exact PoC script, confirming rapid weaponization. Microsoft’s advisory remains silent on in-the-wild activity despite CISA’s prior warning.
This marks the fifth SharePoint vulnerability with confirmed exploitation since June, following CVE-2026-50522, CVE-2026-58644, CVE-2026-56164 and CVE-2026-45659. No technical attribution links the campaigns; honeypot data shows only opportunistic scanning and payload delivery. The pattern indicates public PoC release as the dominant trigger rather than targeted nation-state activity.
Rapid7 also disclosed CVE-2026-63520, patched in August, which chains with CVE-2026-55040 for unauthenticated RCE. Procurement records show SharePoint remains default in multiple U.S. agency environments still running July patches or older.
CISA has not yet added CVE-2026-55040 to KEV. Expect continued scanning and likely successful RCE attempts once the second flaw’s PoC appears.
CISA: CVE-2026-55040 added to KEV catalog within 10 days of first honeypot confirmation
Sources (3)
- [1]Primary Source(https://www.securityweek.com/sharepoint-vulnerability-exploited-shortly-after-poc-release/)
- [2]Supporting Source(https://www.rapid7.com/blog/post/2026/08/11/cve-2026-55040-sharepoint-auth-bypass/)
- [3]Supporting Source(https://www.cisa.gov/news/2026/08/10/cisa-warns-sharepoint-vulnerabilities)