SharePoint Authentication Bypass Exploited After PoC Release

Threat actors have begun exploiting a critical Microsoft SharePoint vulnerability following the public release of a proof-of-concept (PoC) exploit. The flaw, tracked as **CVE-2026-55040** (CVSS score: 9.1), was patched by Microsoft in its July 2026 Patch Tuesday updates but has since been weaponized in real-world attacks. ## Vulnerability Details CVE-2026-55040 is a security feature bypass vulnerability stemming from weak authentication in SharePoint. Microsoft described it as allowing impersonation, enabling attackers to disclose files and modify data without affecting system availability. The vulnerability is the fifth SharePoint flaw exploited this year, following CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522. Successful exploitation allows unauthenticated attackers to bypass authentication on vulnerable SharePoint servers and execute arbitrary operations as a site user or administrator. The issue arises from multiple weaknesses in the JWT token validation pipeline, as detailed by Rapid7. The exploit chains four distinct flaws: 1. A JWT with "alg: none" in the header, eliminating the need for a signature. 2. An actor token with SharePoint's own STS certificate thumbprint in the x5t header, allowing key resolution without verification. 3. The resolved certificate not being in TrustedSecurityTokenServices, enabling issuer acceptance. 4. A non-empty but unverified actor token signature. Rapid7's Python-based PoC demonstrates how attackers can use forged JWT tokens to query domain controllers, enumerate users by SID, and locate site administrators. ## Exploitation Trends Since the PoC's release, exploitation attempts have surged. Telemetry data from KEVIntel shows 12 recorded attempts since July 19, 2026, with eight occurring on August 12 and 13, 2026. These attacks originated from eight unique IP addresses across five regions: Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. The identity and motives of the attackers remain unclear, but the rapid adoption of the PoC highlights the urgency of patching. SharePoint users are strongly advised to apply the latest updates to mitigate risks. ## Mitigation and Recommendations Microsoft has already addressed CVE-2026-55040 in its July 2026 updates, but organizations must ensure their SharePoint instances are patched. Given the active exploitation, immediate action is critical to prevent unauthorized access and data manipulation. - **Apply patches**: Ensure all SharePoint servers are updated with the latest security fixes. - **Monitor for suspicious activity**: Track unauthorized access attempts and unusual JWT token usage. - **Restrict access**: Limit exposure by enforcing strict authentication controls. As exploitation continues, SharePoint administrators should prioritize security measures to safeguard their systems against this evolving threat.