CVE-2026-55040: Microsoft SharePoint — Remote Auth Bypass, Data Exposure (July 2026)

CVE-2026-55040 — Microsoft SharePoint

CVE-2026-55040 is a high-severity vulnerability in Microsoft SharePoint, patched in July 2026, that allows remote, unauthenticated attackers to bypass authentication controls. Successful exploitation enables unauthorized file disclosure and data modification. The vulnerability is being actively exploited in the wild following the public release of a proof-of-concept (PoC) exploit by Rapid7.

Attack Vector

Attackers exploit CVE-2026-55040 by sending crafted HTTP requests to vulnerable SharePoint endpoints. No authentication is required; the flaw allows adversaries to bypass standard access controls and interact directly with SharePoint resources. Exploitation attempts have been observed in honeypot environments, with attackers able to enumerate, access, and modify files remotely. There are no prerequisites beyond network access to the SharePoint instance.

Who Is at Risk

All organizations running unpatched Microsoft SharePoint instances are at risk, regardless of deployment type (on-premises or cloud-connected). The vulnerability affects a broad set of SharePoint versions; Microsoft has not limited advisories to specific industries or geographies, but exploitation has been confirmed in North America. CISA has issued a sector-wide warning.

Patch & Mitigate

• Patch: Apply the July 2026 Microsoft SharePoint security update immediately. Delays increase risk of compromise.
• Workaround: No effective workaround is available; patching is required.
• Detect: Monitor logs for anomalous unauthenticated access to SharePoint endpoints, unexpected file access or modification events, and traffic matching known PoC exploit patterns.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers leverage remote access to gain entry without authentication.
• TA0005 — Defense Evasion: Exploitation bypasses authentication controls, evading standard defenses.
• TA0006 — Credential Access: Attackers may access or modify sensitive files that could contain credentials.

Source: https://www.securityweek.com/sharepoint-vulnerability-exploited-shortly-after-poc-release/