Attackers Exploit SharePoint Authentication Bypass CVE-2026-55040 After Public PoC Release

Threat actors have begun exploiting a newly disclosed Microsoft SharePoint vulnerability, CVE-2026-55040 (CVSS 9.1), following the public release of a proof-of-concept (PoC) exploit by Rapid7. The flaw, patched by Microsoft in its July 2026 Patch Tuesday updates, is a critical security feature bypass stemming from weak authentication. Microsoft’s advisory notes that exploitation could allow an attacker to disclose files and modify data, but not impact system availability.

According to Defused Cyber, attackers are leveraging Rapid7’s PoC, which chains four weaknesses in SharePoint’s JWT token validation pipeline. The issues reside in two classes: SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2. The attack involves sending a JWT with an ‘alg: none’ header, using SharePoint’s own STS certificate thumbprint in the x5t header, and providing a non-empty but unverified signature. This allows an unauthenticated attacker to forge a valid JWT and impersonate any SharePoint site user or administrator.

Rapid7’s Python-based PoC can query a target’s domain controller, enumerate users by SID, and locate a site administrator. Telemetry from KEVIntel shows 12 exploitation attempts since July 19, 2026, with eight occurring on August 12-13, 2026, coinciding with the PoC release. The attempts originated from eight unique IP addresses across five countries: Hong Kong, Japan, the Netherlands, Taiwan, and the U.S.

Organizations using SharePoint are urged to apply the latest patches immediately to mitigate the risk of active exploitation.