SharePoint CVE-2026-55040 went from PoC to active exploitation in hours.

The Hacker News reports attackers began exploiting the CVSS 9.1 authentication bypass on August 13, right after Rapid7 published proof-of-concept code. Remote unauthenticated attackers can impersonate any user including an administrator. Microsoft patched it in July's Patch Tuesday, and it's the fifth SharePoint vuln under active exploitation. Reporting notes a significant portion of the discovery work was done by an AI agent, which is a concrete data point on how much the patch-to-exploit window is compressing.