SharePoint CVE-2026-55040 Comes Under Attack Following Public Exploit
Attackers are actively exploiting critical SharePoint authentication bypass CVE-2026-55040 (CVSS 9.1) days after Rapid7 released a public PoC.
CVE-2026-55040 is a critical authentication bypass (CVSS 9.1) in SharePoint Server Subscription Edition that lets unauthenticated attackers forge JWT tokens and impersonate any user, including administrators. Microsoft patched it in July 2026 Patch Tuesday, but Rapid7 published a technical write-up and Python PoC on GitHub on August 12, and Defused quickly observed attackers running the PoC against SharePoint honeypots. KEVIntel recorded 12 exploitation attempts since July 19, with eight occurring on August 12-13 from IP addresses in Hong Kong, Japan, the Netherlands, Taiwan and the U.S. Admin-level SharePoint access exposes documents and data modification and can serve as a foothold into broader Microsoft 365 infrastructure; unpatched instances should apply the July update immediately.
- CVE-2026-55040 (CVSS 9.1) lets unauthenticated attackers forge JWTs and impersonate any SharePoint user or administrator.
- Exploit chain combines alg:none headers, unverified STS certificate thumbprints, and never-verified signature bytes.
- Rapid7's GitHub PoC enumerates domain users by SID to automatically locate a site administrator.
- KEVIntel logged 12 exploitation attempts since July 19; eight occurred on August 12-13 after PoC release.
- Admin access enables document reading, data modification, and a foothold into Microsoft 365 infrastructure.
- CVEs
- CVE-2026-55040
- Organizations
- MicrosoftRapid7DefusedKEVIntelThe Hacker News
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-55040 | Authentication Bypass in Microsoft SharePoint Server | 9.1 | 70% | KEVPoC ×2 | KEV |
From the original article
2 min read at securityaffairs.com
Attackers are exploiting SharePoint flaw CVE-2026-55040 after a public PoC was released, allowing unauthenticated users to impersonate administrators. Attackers started exploiting CVE-2026-55040 (CVSS score of 9. 1), a critical SharePoint authentication bypass patched in July, within days of Rapid7 releasing a public proof-of-concept on August 12.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.