A critical authentication bypass vulnerability in Microsoft SharePoint, tracked as CVE-2026-55040 with a CVSS score of 9.1, moved from public proof-of-concept to active exploitation in the space of about 24 hours, according to threat intelligence firm Defused, which recorded honeypot hits shortly after security firm Rapid7 published a working exploit. The bug lives in SharePoint's JWT token validation pipeline, where several weaknesses can be chained together to let a completely unauthenticated remote attacker forge a valid token and impersonate any user on the SharePoint site, including administrators. Microsoft actually patched the underlying flaw back in July as part of that month's Patch Tuesday cycle, but patching a vulnerability and having every affected organization actually apply that patch are two very different things, and this incident is a reminder of how short that gap has become. Once an attacker has administrator-level impersonation on SharePoint, they can read and modify documents across the organization, and potentially use that access as a foothold into the wider Microsoft 365 environment the SharePoint instance is connected to. Researchers have also noted that CVE-2026-55040 can be chained with a separate flaw, CVE-2026-63520, to escalate from authentication bypass all the way to unauthenticated remote code execution, which raises the stakes considerably for anyone still running an unpatched, internet-facing SharePoint Server. For engineering and security teams, the practical takeaway is straightforward: confirm the July patch is actually deployed across every SharePoint instance, treat any SharePoint server exposed to the internet as high priority, and watch logs for anomalous administrative actions that could indicate a forged token was already used before the patch went in. The speed of weaponization here, from patch to PoC to honeypot hits within roughly a month and then to active exploitation within a day of the exploit code going public, continues a trend of shrinking windows between vulnerability disclosure and real-world attack that defenders have to plan around rather than treat as an edge case.