Threat actors have begun to exploit a newly disclosed Microsoft SharePoint vulnerability following the release of a proof-of-concept (PoC) code.
The vulnerability in question is CVE-2026-55040 (CVSS score: 9.1), which refers to a critical security feature bypass that stems from weak authentication. It was patched by Microsoft as part of its July 2026 Patch Tuesday updates.
“The authentication feature could be bypassed as this vulnerability allows impersonation,” Microsoft said in an advisory for the flaw last month. “Exploiting this vulnerability could allow an attacker to disclose files and modify data, but the attacker cannot impact the availability of the system.”
According to Defused Cyber, threat actors are leveraging a PoC exploit released by Rapid7 earlier this week, once again indicating fresh flaws are being abused in real-world attacks.
Successful exploitation of CVE-2026-55040 can allow an unauthenticated attacker to sidestep authentication on a vulnerable SharePoint server and perform arbitrary operations as a SharePoint site user or administrator. The vulnerability, per Rapid7, is due to “several issues” in the JWT token validation pipeline.
Specifically, it chains four different weaknesses to allow an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user. Rapid7 said the issue resides in two different classes that implement the token parsing and validation logic for Bearer service-to-service (S2S) tokens –
- SPJsonWebSecurityTokenHandlerV2
- SPJsonWebSecurityBaseTokenHandlerV2
The entire chain can be exploited by an attacker as follows –
- Attacker sends a JWT with “alg: none” in the outer header, so no signature is required in the outer token.
- The actor token’s x5t header contains SharePoint’s own STS certificate thumbprint, making it possible to resolve a signing key with no verification.
- The resolved certificate is not in TrustedSecurityTokenServices, allowing the issuer to be accepted.
- The actor token’s signature is a non-empty value, e.g., AAAA, which is never verified.
Rapid7’s Python-based PoC uses the forged JWT token to query a target’s domain controller, enumerate users by SID, and auto-locate the SID for the user to find a site administrator.
As of writing, it’s unclear who is behind the exploitation activity or what their end goals are. Telemetry data captured by KEVIntel shows that a total of 12 exploitation attempts were recorded since July 19, 2026. Out of these, eight took place on August 12 and 13, 2026, indicating that the release of the PoC has played a role in these efforts.
The 12 exploitation attempts have originated from eight unique IP addresses corresponding to five countries and regions, including Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. In light of a spike in active exploitation, SharePoint users are advised to keep their instances up-to-date for optimal protection.
