Summary
- Honeypots recorded attempts to exploit CVE-2026-55040 shortly after Rapid7 published technical details and PoC code.
- Rapid7 separately disclosed CVE-2026-63520, which can be chained with the authentication bypass for unauthenticated remote code execution.
- Microsoft has patched both flaws, while the actor behind the observed exploitation attempts remains unknown.
Honeypots have recorded attempts to exploit a patched SharePoint authentication-bypass vulnerability using proof-of-concept code published a day earlier, illustrating how quickly detailed public research can translate into hostile internet traffic.
CVE-2026-55040 affects on-premises editions of Microsoft SharePoint Server and was patched in July. Rapid7 published technical analysis and a proof-of-concept script on 11 August showing how a remote, unauthenticated attacker could bypass authentication and operate as a SharePoint site user or administrator.
Threat-intelligence provider Defused subsequently reported that its honeypots recorded exploitation attempts using the newly published technique. There is no public attribution for the activity, and Microsoft’s advisory had not been updated to mark the vulnerability as exploited at the time of reporting.
The development coincides with disclosure of a second vulnerability, CVE-2026-63520, discovered by Rapid7 during the same research project. That flaw affects SharePoint’s Business Connectivity Services and can allow arbitrary code execution on the server using the privileges of the SharePoint site’s service account.
CVE-2026-63520 carries a high-severity rating on its own. When chained with CVE-2026-55040, however, the authentication barrier disappears and the combined path provides unauthenticated remote code execution against a vulnerable SharePoint server.
Microsoft addressed the second vulnerability in its August updates across supported SharePoint Server releases. Rapid7 said the RCE issue also affects certain versions of Project Server and Office Web Apps Server, although its own research concentrated on SharePoint.
The exploitation observed so far concerns CVE-2026-55040 rather than the newly disclosed RCE component. There was no evidence in the material reviewed for this article that CVE-2026-63520 was being exploited in active attacks.
The distinction is important because SharePoint has already faced a run of exploited vulnerabilities this summer. A separate SharePoint vulnerability has now been linked to ransomware activity, while Microsoft’s July security release also contained exploited SharePoint flaws.
On-premises SharePoint servers occupy a particularly sensitive position because they frequently contain internal documents, business workflows, employee information, and links to identity infrastructure. Unlike SharePoint Online, responsibility for patching and exposure management remains with the organisation operating the server.
The publication of proof-of-concept code changes the operating conditions around a vulnerability even when the underlying defect has already been patched. Researchers, defenders, and attackers can all use the additional technical detail. Internet scanning and automated exploitation attempts can begin quickly, particularly for flaws with network-reachable attack paths and widely deployed targets.
Rapid7’s research also adds a separate dimension to the disclosure. The company used publicly available AI models alongside expert-led reverse engineering and manual analysis while developing the exploit chain. Rapid7 said fully automated approaches initially produced inaccurate results, but more structured agentic workflows eventually contributed to discovery of the authentication bypass and the later RCE weakness.
That research does not establish that the exploitation now being observed is AI-assisted. It does, however, demonstrate that vulnerability discovery itself is becoming more accessible to AI-supported workflows at the same time that proof-of-concept publication can rapidly convert a disclosed weakness into observable hostile traffic.
Both vulnerabilities now have vendor fixes. The immediate uncertainty lies in the scale and intent of the CVE-2026-55040 activity, and whether attackers progress from scanning and PoC reproduction towards operational exploitation of the full SharePoint chain.
