Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

Threat actors have begun to exploit a newly disclosed Microsoft SharePoint vulnerability following the release of a proof-of-concept (PoC) code.

The vulnerability in question is CVE-2026-55040 (CVSS score: 9.1), which refers to a critical security feature bypass that stems from weak authentication. It was patched by Microsoft as part of its July 2026 Patch Tuesday updates.

“The authentication feature could be bypassed as this vulnerability allows impersonation,” Microsoft said in an advisory for the flaw last month. “Exploiting this vulnerability could allow an attacker to disclose files and modify data, but the attacker cannot impact the availability of the system.”

According to Defused Cyber, threat actors are leveraging a PoC exploit released by Rapid7 earlier this week, once again indicating fresh flaws are being abused in real-world attacks.

Successful exploitation of CVE-2026-55040 can allow an unauthenticated attacker to sidestep authentication on a vulnerable SharePoint server and perform arbitrary operations as a SharePoint site user or administrator. The vulnerability, per Rapid7, is due to “several issues” in the JWT token validation pipeline.

Specifically, it chains four different weaknesses to allow an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user. Rapid7 said the issue resides in two different classes that implement the token parsing and validation logic for Bearer service-to-service (S2S) tokens –

• SPJsonWebSecurityTokenHandlerV2
• SPJsonWebSecurityBaseTokenHandlerV2

The entire chain can be exploited by an attacker as follows –

• Attacker sends a JWT with “alg: none” in the outer header, so no signature is required in the outer token.
• The actor token’s x5t header contains SharePoint’s own STS certificate thumbprint, making it possible to resolve a signing key with no verification.
• The resolved certificate is not in TrustedSecurityTokenServices, allowing the issuer to be accepted.
• The actor token’s signature is a non-empty value, e.g., AAAA, which is never verified.

Rapid7’s Python-based PoC uses the forged JWT token to query a target’s domain controller, enumerate users by SID, and auto-locate the SID for the user to find a site administrator.