Attackers began exploiting a critical Microsoft SharePoint authentication bypass within days of a researcher publishing proof-of-concept technical analysis, according to Microsoft’s security advisory and reporting confirmed by Help Net Security. The flaw, tracked as CVE-2026-55040, lets a remote, unauthenticated attacker bypass SharePoint’s authentication checks entirely.
Rapid7 researcher Stephen Fewer, who published the technical analysis, wrote that “a remote unauthenticated attacker can leverage CVE-2026-55040 to bypass authentication on a vulnerable SharePoint server, and perform operations as a SharePoint site user or administrator.” Microsoft’s own advisory describes the flaw as allowing impersonation that lets an attacker “disclose files and modify data,” while stating the bug alone does not affect system availability. Microsoft patched the vulnerability in its July 2026 Patch Tuesday release. The danger now is the population of servers that have not yet applied it, plus the fact that chaining CVE-2026-55040 with a second flaw, CVE-2026-63520, can escalate to unauthenticated remote code execution.
The affected products are SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, on premises deployments frequently left internet facing for partner and vendor collaboration. That exposure pattern is what makes this brief’s real insight matter: authentication bypass bugs in internet facing collaboration platforms have become one of 2026’s most consistent intrusion vectors, following the same shape as the unauthenticated flaws that repeatedly put TeamCity build servers and Langflow’s AI orchestration platform on CISA’s Known Exploited Vulnerabilities list this year. The pattern security leaders should draw from all three: any server side application authenticating its own users, rather than delegating to an external identity provider with modern session validation, is now a preferred target the moment a bypass surfaces.
Security teams running any of the three affected SharePoint versions should apply the July 2026 cumulative update immediately if they have not already, and should not wait for a Known Exploited Vulnerabilities listing to treat this as urgent given active exploitation is already underway. Where immediate patching is not possible, Microsoft’s guidance is to avoid exposing SharePoint directly to the internet and to place it behind a Layer 7 reverse proxy that enforces its own authentication.
