[CVE-2026-55040]

August 26, 2026

• A forum actor is circulating target lists for two authentication-bypass flaws. DailyDarkWeb reports roughly 14,000 hosts potentially relevant to SharePoint CVE-2026-55040 and a separate list of roughly 24,000 internet-facing hosts for macOS Screen Sharing CVE-2026-65400. These are exposure claims, not proof of vulnerable versions or compromise. · Vulnerabilities & Exploits

in Oracle WebLogic Is Under Active Attack

August 13, 2026

• SharePoint auth-bypass CVE-2026-55040 is now being exploited in the wild shortly after Rapid7 dropped a PoC on Patch Tuesday. The flaw stems from improper JWT validation that lets an attacker forge unsigned tokens and impersonate any user, including admins, and chains with the RCE flaw CVE-2026-63520 (earlier coverage). See BleepingComputer, Rapid7's technical analysis, and Viettel's writeup. · Offensive & Exploitation

in ShieldBreak Turns a "Patched" Defender Bug Back Into SYSTEM

July 15, 2026

• Rapid7 disclosed CVE-2026-55040, a SharePoint JWT authentication bypass allowing user impersonation, now fixed. A researcher notes it chains with the Flow2Shell bug (CVE-2026-47298) for a full pre-auth path. Rapid7, MSRC · Vulnerabilities & Exploits

in Record-Breaking Patch Tuesday Ships With Live Active Directory and SharePoint Zero-Days