Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
Attackers exploit SharePoint authentication bypass CVE-2026-55040 (CVSS 9.1) after Rapid7's PoC release, with 12 exploitation attempts recorded since July 19, 2026.
Microsoft patched CVE-2026-55040 in its July 2026 Patch Tuesday; the 9.1-severity flaw chains four weaknesses in SharePoint's JWT token validation pipeline, letting unauthenticated attackers forge valid JWTs and impersonate any SharePoint site user or administrator. Threat actors began exploiting the bug after Rapid7 released a Python PoC that forges tokens and enumerates domain users by SID. KEVIntel telemetry shows 12 exploitation attempts since July 19, 2026, eight of them on August 12-13 following the PoC release, originating from eight IPs across Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. This is the fifth SharePoint vulnerability exploited this year, alongside CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522.
- PoC exploits 'alg: none' JWT chain in SPJsonWebSecurityTokenHandlerV2 classes.
- Forged token impersonates any SharePoint site user or administrator.
- Exploitation spiked on August 12-13 after the Rapid7 PoC release.
- Microsoft patched the flaw in July 2026 Patch Tuesday updates.
- Defenders urged to keep SharePoint instances fully updated.
- Products
- SharePoint
- Organizations
- Defused CyberKEVIntel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-45659 | Authenticated Deserialization RCE in Microsoft SharePoint Server (Actively Exploited) | 8.8 | 80% | KEVRansomware | KEV |
CVE-2026-58644+2 related CVEs | Unauthenticated Deserialization RCE in Microsoft SharePoint Server | 9.8 group max | 16% | KEV | KEV |
| CVE-2026-56164 | Missing Authentication in Microsoft SharePoint Server Allows Privilege Escalation | 9.8 | 1% | KEV | KEV |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Aug 13, 2026 Vulnerability / Enterprise Security Threat actors have begun to exploit a newly disclosed Microsoft SharePoint vulnerability following the release of a proof-of-concept (PoC) code. The vulnerability in question is CVE-2026-55040 (CVSS score: 9. 1), which refers to a critical security feature bypass that stems from weak authentication.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.