One day from Rapid7's SharePoint PoC to attacks on honeypots

Rapid7 published a technical writeup and a proof-of-concept exploit for CVE-2026-55040, an authentication bypass in Microsoft SharePoint, on Tuesday ^[1][2]. By the following day, threat intelligence firm Defused said attackers were firing that same code at its SharePoint honeypots ^[3][4], an interval of roughly one day between public exploit code and live attempts ^[5].

The flaw sits in SharePoint's JWT token validation pipeline and allows an attacker with no privileges to perform operations as a SharePoint site user or administrator ^[2]. Microsoft's own wording is that the authentication feature can be bypassed because the vulnerability allows impersonation, and that an attacker could disclose files and modify data but could not affect availability ^[6]. Read and write access to content is sufficient for data theft and extortion; availability is the part backups already cover.

The patch shipped in the July 2026 Patch Tuesday updates, with Microsoft explicitly naming SharePoint Enterprise Server 2016 and SharePoint Server 2019 ^[7]. The second Tuesday of July 2026 was July 14 ^[8], which puts CISA's July 15 warning to defenders the day after the fix was available and well before any public exploit existed ^[9]. BleepingComputer attributes that early advisory to Microsoft's exploitability assessment rather than to observed attacks ^[10].

Two caveats worth keeping straight. Microsoft has labeled the flaw an attractive target for attackers but has not marked it as successfully exploited in the wild ^[11], so the exploitation signal here rests on Defused's honeypot telemetry alone. And while Shadowserver tracks more than 8,500 SharePoint servers exposed online, there is no breakdown of how many are honeypots or already patched ^[12], so treat that figure as an upper bound on the attack surface, not a count of vulnerable hosts.

CISA's guidance is unglamorous and mostly architectural: do not expose SharePoint directly to the internet unless necessary, review Microsoft's hardening guidance ^[13], block external access to SharePoint Central Administration, restrict farm and database communication to required systems, and put anything that must be internet-facing behind a Layer 7 reverse proxy or equivalent application-layer control ^[14].

The base rate argues for urgency. Since November 2021, CISA has flagged 14 actively exploited SharePoint vulnerabilities, eight of which were also used in ransomware attacks ^[15], meaning a majority of exploited SharePoint bugs in that period ended up in extortion operations ^[16]. That pipeline is running right now: on Tuesday CISA confirmed that CVE-2026-45659, a high-severity SharePoint remote code execution flaw exploited since early July, is now being used by ransomware gangs as well ^[17].

What to watch: whether Microsoft changes CVE-2026-55040's status to exploited, whether the Shadowserver exposure count of 8,500-plus falls in the coming weeks ^[12], and whether 55040 follows 45659 from opportunistic scanning into ransomware tooling. For anyone still on the July backlog, the operative assumption is that public PoC plus unpatched 2016 or 2019 equals same-day contact.