SharePoint CVE-2026-55040 Comes Under Attack Following Public Exploit
Attackers are actively exploiting critical SharePoint authentication bypass CVE-2026-55040 (CVSS 9.1) days after Rapid7 released a public PoC.
CVE-2026-55040 is a critical authentication bypass (CVSS 9.1) in SharePoint Server Subscription Edition that lets unauthenticated attackers forge JWT tokens and impersonate any user, including administrators. Microsoft patched it in July 2026 Patch Tuesday, but Rapid7 published a technical write-up and Python PoC on GitHub on August 12, and Defused quickly observed attackers running the PoC against SharePoint honeypots. KEVIntel recorded 12 exploitation attempts since July 19, with eight occurring on August 12-13 from IP addresses in Hong Kong, Japan, the Netherlands, Taiwan and the U.S. Admin-level SharePoint access exposes documents and data modification and can serve as a foothold into broader Microsoft 365 infrastructure; unpatched instances should apply the July update immediately.
- CVE-2026-55040 (CVSS 9.1) lets unauthenticated attackers forge JWTs and impersonate any SharePoint user or administrator.
- Exploit chain combines alg:none headers, unverified STS certificate thumbprints, and never-verified signature bytes.
- Rapid7's GitHub PoC enumerates domain users by SID to automatically locate a site administrator.
- KEVIntel logged 12 exploitation attempts since July 19; eight occurred on August 12-13 after PoC release.
- Admin access enables document reading, data modification, and a foothold into Microsoft 365 infrastructure.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-55040 | Authentication Bypass in Microsoft SharePoint Server Microsoft SharePoint Server is affected by a weak authentication vulnerability (CWE-1390) that allows an unauthorized attacker to bypass a security feature over a network. Per the CVSS vector, exploitation requires no privileges and no user interaction with low attack complexity, so any unauthenticated attacker with network access to a vulnerable server can trigger it remotely. Impact to confidentiality and integrity is rated high (CVSS 9.1, critical), meaning the bypass effectively grants the attacker access that authentication should have prevented, with no direct availability impact. All organizations running on-premises Microsoft SharePoint Server are potentially affected; the source data does not specify affected version ranges or fixed builds, so defenders should consult Microsoft's advisory for those details. The flaw is under active exploitation: a public proof-of-concept is available on GitHub, attackers began exploiting it after the PoC went public, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18 (EPSS ~40%, 99th percentile; ransomware association unknown). Do: Apply Microsoft's security update for CVE-2026-55040 immediately, prioritizing internet-facing SharePoint servers, and comply with CISA BOD 26-04 and the agency's Forensics Triage Requirements, including checking for signs of prior compromise on SharePoint servers. Use the public GitHub proof-of-concept to validate patching and detection coverage, and restrict network exposure of SharePoint until all servers are updated. | 9.1 | 51% | KEV PoC ×2 |
| mass≈tens of thousands of internet-exposed SharePoint Server instances, within an installed base spanning hundreds of thousands of enterprise and government… |
Full article455 words · extracted from securityaffairs.com · click to collapse
Attackers are exploiting SharePoint flaw CVE-2026-55040 after a public PoC was released, allowing unauthenticated users to impersonate administrators.
Attackers started exploiting CVE-2026-55040 (CVSS score of 9.1), a critical SharePoint authentication bypass patched in July, within days of Rapid7 releasing a public proof-of-concept on August 12. The vulnerability allows an unauthenticated attacker impersonate any SharePoint user or administrator without valid credentials. Microsoft patched it in July’s Patch Tuesday, anyone who hasn’t applied that update is directly exposed.
CVE-2026-55040 is a critical SharePoint authentication bypass. An unauthenticated attacker can exploit weaknesses in JWT validation to forge tokens and impersonate any SharePoint user, including administrators.
“A critical authentication bypass vulnerability exists in SharePoint Server Subscription Edition’s JWT token validation pipeline. The root cause is a chain of four distinct weaknesses that, when combined, allow an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user.” wrote Rapid7.
The exploit chain works by sending a JWT with “alg: none” in the outer header so no signature is required, using SharePoint’s own STS certificate thumbprint to resolve a signing key without verification, and then passing a non-empty but never-verified signature like “AAAA.” The result is a fully forged token that SharePoint accepts as legitimate.
Defused researchers observed attackers using the Rapid7 POC for CVE-2026-55040 against our SharePoint their honeypots.
— Defused (@DefusedCyber) August 12, 2026🚨 Attackers are now using the @rapid7 POC for CVE-2026-55040 against our SharePoint honeypots
The vulnerability is a Microsoft SharePoint JWT auth bypass for which Rapid7 published a technical writeup and proof-of-concept code yesterday.
Track it live 👉… pic.twitter.com/Q8fbMyGq95
Rapid7’s Python-based PoC, available on GitHub, uses the forged JWT token to query the target’s domain controller, enumerate users by SID, and automatically locate a site administrator. That last step matters because getting administrator-level access to SharePoint means access to documents, the ability to modify data, and a potential foothold into broader Microsoft 365 infrastructure. Microsoft’s advisory notes the attacker can’t disrupt availability, but reading files and modifying data across a SharePoint farm is damaging enough on its own.
The Hacker News reported that KEVIntel recorded 12 exploitation attempts since July 19, with eight occurring on August 12–13 after the public PoC release. The activity came from eight IP addresses across Hong Kong, Japan, the Netherlands, Taiwan and the U.S.
The spike immediately after the PoC publication confirms the pattern that repeats with nearly every high-severity vulnerability: public exploit code collapses the window between patch availability and active exploitation. Who’s behind these attempts and what they’re after remains unknown.
If your SharePoint instances haven’t received the July 2026 Patch Tuesday update, that’s the immediate action.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CVE-2026-55040)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/197137/hacking/sharepoint-cve-2026-55040-comes-under-attack-following-public-exploit.html