Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
Attackers have begun to exploit a newly disclosed Microsoft SharePoint vulnerability following the release of a proof-of-concept (PoC) code. The vulnerability in question is CVE-2026-55040, which refers to a critical security feature bypass that stems from weak authentica…
Intelligence analysis by Llama
Threat actors are leveraging a PoC exploit released by Rapid7, indicating fresh flaws are being abused in real-world attacks. Successful exploitation of CVE-2026-55040 can allow an unauthenticated attacker to sidestep authentication on a vulnerable SharePoint server and perform arbitrary operations as a SharePoint site user or administrator.
Imagine you have a super-long password that's hard to guess, but an attacker finds a way to pretend to be you and do things on your account without actually knowing your password. This is what's happening with the SharePoint vulnerability - attackers are finding a way to bypass the password system and do things on the account without knowing the password.
Analysis
Vulnerability Overview
The vulnerability in question is CVE-2026-55040 (CVSS score: 9.1), which refers to a critical security feature bypass that stems from weak authentication. It was patched by Microsoft as part of its July 2026 Patch Tuesday updates.
Exploitation Activity
According to Defused Cyber, threat actors are leveraging a PoC exploit released by Rapid7 earlier this week, once again indicating fresh flaws are being abused in real-world attacks. Successful exploitation of CVE-2026-55040 can allow an unauthenticated attacker to sidestep authentication on a vulnerable SharePoint server and perform arbitrary operations as a SharePoint site user or administrator.
Implications
The vulnerability, per Rapid7, is due to 'several issues' in the JWT token validation pipeline. Specifically, it chains four different weaknesses to allow an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user. Rapid7 said the issue resides in two different classes that implement the token parsing and validation logic for Bearer service-to-service (S2S) tokens - SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2.
Exploitation Details
The entire chain can be exploited by an attacker as follows: the attacker sends a JWT with 'alg: none' in the outer header, so no signature is required in the outer token. The actor token's x5t header contains SharePoint's own STS certificate thumbprint, making it possible to resolve a signing key with no verification. The resolved certificate is not in TrustedSecurityTokenServices, allowing the issuer to be accepted. The actor token's signature is a non-empty value, e.g., AAAA, which is never verified.
Telemetry Data
As of writing, it's unclear who is behind the exploitation activity or what their end goals are. Telemetry data captured by KEVIntel shows that a total of 12 exploitation attempts were recorded since July 19, 2026. Out of these, eight took place on August 12 and 13, 2026, indicating that the release of the PoC has played a role in these efforts.
Key points
- Threat actors are exploiting a newly disclosed Microsoft SharePoint vulnerability.
- The vulnerability in question is CVE-2026-55040, which refers to a critical security feature bypass that stems from weak authentication.
- Successful exploitation of CVE-2026-55040 can allow an unauthenticated attacker to sidestep authentication on a vulnerable SharePoint server and perform arbitrary operations as a SharePoint site user or administrator.
- The vulnerability, per Rapid7, is due to 'several issues' in the JWT token validation pipeline.
- Telemetry data captured by KEVIntel shows that a total of 12 exploitation attempts were recorded since July 19, 2026.
If the vulnerability is patched quickly and users keep their instances up-to-date, the risk of exploitation can be minimized. Additionally, if the attackers' end goals are not malicious, the exploitation activity may not lead to significant consequences.
If the vulnerability is not patched quickly, the risk of exploitation can increase, and attackers may be able to cause significant damage. Additionally, if the attackers' end goals are malicious, the exploitation activity may lead to serious consequences, such as data breaches or system compromise.
