Attackers started exploiting CVE-2026-55040 (CVSS score of 9.1), a critical SharePoint authentication bypass patched in July, within days of Rapid7 releasing a public proof-of-concept on August 12. The vulnerability allows an unauthenticated attacker impersonate any SharePoint user or administrator without valid credentials. Microsoft patched it in July’s Patch Tuesday, anyone who hasn’t applied that update is directly exposed.
CVE-2026-55040 is a critical SharePoint authentication bypass. An unauthenticated attacker can exploit weaknesses in JWT validation to forge tokens and impersonate any SharePoint user, including administrators.
“A critical authentication bypass vulnerability exists in SharePoint Server Subscription Edition’s JWT token validation pipeline. The root cause is a chain of four distinct weaknesses that, when combined, allow an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user.” wrote Rapid7.
The exploit chain works by sending a JWT with “alg: none” in the outer header so no signature is required, using SharePoint’s own STS certificate thumbprint to resolve a signing key without verification, and then passing a non-empty but never-verified signature like “AAAA.” The result is a fully forged token that SharePoint accepts as legitimate.
Defused researchers observed attackers using the Rapid7 POC for CVE-2026-55040 against our SharePoint their honeypots.
Rapid7’s Python-based PoC, available on GitHub, uses the forged JWT token to query the target’s domain controller, enumerate users by SID, and automatically locate a site administrator. That last step matters because getting administrator-level access to SharePoint means access to documents, the ability to modify data, and a potential foothold into broader Microsoft 365 infrastructure. Microsoft’s advisory notes the attacker can’t disrupt availability, but reading files and modifying data across a SharePoint farm is damaging enough on its own.
The Hacker News reported that KEVIntel recorded 12 exploitation attempts since July 19, with eight occurring on August 12–13 after the public PoC release. The activity came from eight IP addresses across Hong Kong, Japan, the Netherlands, Taiwan and the U.S.
The spike immediately after the PoC publication confirms the pattern that repeats with nearly every high-severity vulnerability: public exploit code collapses the window between patch availability and active exploitation. Who’s behind these attempts and what they’re after remains unknown.
If your SharePoint instances haven’t received the July 2026 Patch Tuesday update, that’s the immediate action.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CVE-2026-55040)