Attackers have begun exploiting a critical authentication bypass vulnerability in Microsoft SharePoint, designated CVE-2026-55040, following the public release of a proof-of-concept (PoC) exploit. The flaw, which carries a CVSS score of 9.1, allows unauthenticated attackers to impersonate any SharePoint user, including administrators.
Microsoft addressed CVE-2026-55040 in its July 2026 Patch Tuesday updates. However, within days of Rapid7 publishing a technical write-up and Python-based PoC on GitHub on August 12, active exploitation attempts were observed.
The vulnerability stems from a chain of four distinct weaknesses in SharePoint Server Subscription Edition's JSON Web Token (JWT) validation pipeline. By exploiting these weaknesses, an unauthenticated remote attacker can forge a valid JWT, which SharePoint accepts as legitimate. Specifically, the exploit involves sending a JWT with `alg: none` in the outer header, bypassing signature requirements, and then using SharePoint's own Security Token Service (STS) certificate thumbprint to resolve a signing key without verification. A non-empty but unverified signature, such as "AAAA," completes the forged token.
Security researchers from Defused reported observing attackers leveraging Rapid7's PoC against their SharePoint honeypots on August 12. The PoC itself is designed to use the forged JWT to query a target's domain controller, enumerate users by Security Identifier (SID), and automatically identify a site administrator. Gaining administrator-level access to SharePoint provides access to documents, the ability to modify data, and a potential entry point into broader Microsoft 365 infrastructure.
While Microsoft's advisory indicates that the vulnerability does not allow attackers to disrupt availability, the ability to read and modify files across a SharePoint farm presents significant risks.
Data from KEVIntel indicates that 12 exploitation attempts related to CVE-2026-55040 were recorded since July 19. A notable spike occurred on August 12-13, with eight of these attempts taking place immediately after the public PoC release. These attempts originated from eight distinct IP addresses across various regions, including Hong Kong, Japan, the Netherlands, Taiwan, and the United States.
This rapid increase in exploitation activity immediately following the publication of public exploit code underscores a recurring pattern where the window between patch availability and active exploitation collapses for high-severity vulnerabilities. The identities of the attackers and their specific objectives remain unknown at this time. Organizations operating SharePoint instances that have not yet applied the July 2026 Patch Tuesday updates are advised to do so immediately to mitigate exposure.
