A SharePoint vulnerability, CVE-2026-55040, is now being actively exploited in the wild shortly after Rapid7 published technical details and a proof-of-concept script. Microsoft has also patched CVE-2026-63520, which could be chained with CVE-2026-55040 to enable unauthenticated remote code execution on SharePoint servers. #CVE-2026-55040 #Rapid7 #CVE-2026-63520 #Microsoft #SharePoint
Keypoints
- Microsoft fixed CVE-2026-55040 in July Patch Tuesday updates.
- Rapid7 disclosed technical details and released a PoC script for the flaw.
- Defused reported real-world exploitation attempts using the Rapid7 PoC.
- CVE-2026-63520 may be chained with CVE-2026-55040 for remote code execution.
- CISA warned organizations to keep SharePoint instances fully patched.
Read More: https://www.securityweek.com/sharepoint-vulnerability-exploited-shortly-after-poc-release/