Rapid7 researchers have disclosed a two-vulnerability chain that achieves unauthenticated remote code execution against on-premises SharePoint servers — and a ransomware group is already hunting for targets.

The first half, CVE-2026-55040 (CVSS 9.1), is a JWT authentication bypass that lets an attacker forge tokens and impersonate any SharePoint user, including site admins. Microsoft patched it on July 14. The second half — a remote code execution flaw that converts that impersonation into arbitrary code execution on the server itself — won’t be patched until August 12’s Patch Tuesday.

That creates a dangerous window. The auth bypass details are public. The RCE fix hasn’t dropped yet. And Storm-2603, the group behind Warlock ransomware, has been actively targeting on-prem SharePoint since mid-2025 using similar exploit chains — deploying ransomware via DLL hijacking and Cloudflare tunnels to maintain persistence.

Who’s exposed

Any organisation running SharePoint Server 2016, 2019 or Subscription Edition on-premises. SharePoint Online (Microsoft 365) is not affected.

What to do right now

Confirm July’s security updates are applied — specifically KB5002882 (Subscription Edition), KB5002883 (2019) or KB5002892 (2016). Applying the July patch breaks the exploit chain even without the August RCE fix. Run PSConfig on every farm server after patching — skipping this leaves the farm partially patched and still vulnerable.

Prioritise internet-facing SharePoint instances first. Internal-only servers should follow within 48 hours. Then watch for August Patch Tuesday on the 12th and apply same-day.

We see plenty of Australian businesses — particularly in financial services and the NFP sector — still running on-prem SharePoint for compliance or data sovereignty reasons. If that’s you, this one’s a “stop what you’re doing and check” situation. CISA gave US federal agencies a three-day remediation deadline for CVE-2026-55040. Your patching cadence should be at least that aggressive.

Not sure whether your SharePoint environment is current? Get in touch — we can check for you.