SharePoint Server Under Active Attack: What to Do Now

A vulnerability in Microsoft SharePoint Server that was patched in July has come under active attack following the public release of working exploit code. If your business runs SharePoint Server on its own network or servers, this needs your attention today.

What has happened

CVE-2026-55040 is an authentication bypass in Microsoft SharePoint Server. The flaw is rooted in how SharePoint handles JSON Web Tokens (JWTs) — the digital credentials it uses to confirm who a user is. An attacker can forge these tokens without needing a password, an account, or any interaction from your staff. Once forged, the token grants access to sensitive documents, administrative settings, and collaboration sites as though the attacker were a legitimate user.

Microsoft patched the vulnerability on 14 July 2026 as part of its regular monthly security update. For several weeks the risk appeared theoretical. Then, in mid-August, security researchers published proof-of-concept exploit code showing exactly how the attack works. Exploitation in the wild followed almost immediately. The US Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation and added CVE-2026-55040 to its Known Exploited Vulnerabilities (KEV) catalogue on 18 August 2026.

SharePoint Online, the version included in Microsoft 365 cloud subscriptions, is not affected. This vulnerability is specific to on-premises SharePoint Server — that is, SharePoint running on your own infrastructure rather than in Microsoft’s cloud. The affected versions are SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server Enterprise 2016.

Why it matters to your business

The danger here is not the vulnerability itself — it is the gap between when the patch was released and when businesses actually apply it. Microsoft fixed this in July; it is now late August. Any business still running an unpatched SharePoint Server has been exposed for over six weeks, and attackers now have a ready-made, publicly available tool to find and exploit it.

An attacker exploiting this flaw needs no passwords. They need no staff member to click a link or open an attachment. If your SharePoint Server is reachable from the internet, the threshold for attack is effectively zero.

For businesses in professional services, legal, accountancy, or any sector where SharePoint holds client files and collaboration data, a successful attack could expose sensitive records, financial information, or commercially confidential material — often without triggering the usual login alerts, because the attacker appears to be an authenticated user.

What we have already done

If System Force IT manages your server patching, the July 2026 updates will have been deployed. If your business uses SharePoint through Microsoft 365 (SharePoint Online), you are not affected by this vulnerability at all.

If you manage your own servers, or if your IT support is handled by another provider, there are two immediate priorities: find out whether you are running on-premises SharePoint Server, and if so, confirm the July cumulative update has been applied.

What to check or do

1. Identify which SharePoint you are on. If your SharePoint address ends in sharepoint.com you are on SharePoint Online and not at risk from this flaw. If you access SharePoint via an internal IP address, a server name, or your own domain name, you are likely running on-premises.
2. Apply the July 2026 patch immediately. The fix was included in Microsoft’s July Patch Tuesday cumulative update. If it has not been applied, this is urgent.
3. Restrict external access while you confirm patching. If your SharePoint Server is accessible from the internet, consider placing it behind a VPN or tightening firewall rules until the update is confirmed.
4. Review your authentication and access logs. Look for unusual sign-in events, access to SharePoint administration pages, or activity from unfamiliar accounts or locations.
5. Consider whether on-premises SharePoint still makes sense. Many businesses running ageing SharePoint Server installations find that migrating to SharePoint Online reduces maintenance overhead, removes this class of vulnerability entirely, and often costs less than keeping servers patched and supported. Our cloud migration team can walk you through the options.

The wider lesson

This incident follows a familiar pattern: a patch is released, most managed businesses apply it quickly, then a public exploit appears weeks later and sweeps up the organisations that fell behind. It is one of the strongest arguments for having someone actively manage and monitor your patching rather than leaving it to chance. A missed update in July can become a breach headline in August.

For more on building resilience around exactly these scenarios, our cyber incident response guide and IT security services pages are good starting points.

If you are unsure whether your SharePoint installation is patched, or you would like a review of your server estate and patching posture, get in touch with the System Force IT team via our contact page or call 01452 701355 for a no-obligation conversation. Our managed IT services include proactive patching as standard, so this kind of exposure simply does not arise.