Overview
- CISA has confirmed that ransomware operators are abusing a high-severity SharePoint remote code execution bug, CVE-2026-45659, and added it to its Known Exploited Vulnerabilities catalog to force rapid remediation by federal agencies.
- Security firm Rapid7 published a technical write-up and proof-of-concept for a JWT authentication bypass, CVE-2026-55040, and researchers showed how that bypass can be chained to an RCE (CVE-2026-63520) with heavy AI-assisted research.
- Rapid7's publicly released PoC for the JWT bypass was observed being weaponized against SharePoint honeypots, and vendors report active exploitation traffic rising after the disclosures.
- Microsoft issued July updates that break the known exploit chains, but Shadowserver reports roughly 8,500 SharePoint servers exposed online with more than 200 still unpatched for CVE-2026-45659 and many farms running end-of-support 2016/2019 releases.
- Network defenders should apply Microsoft’s July fixes, harden or remove direct Internet exposure, hunt for compromise artifacts, and prepare incident response because unpatched on-premises SharePoint servers face elevated ransomware and data‑theft risk.