Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

Masked attacker forging a JWT token against SharePoint interface

Microsoft’s SharePoint platform is facing active exploitation following the public release of a proof-of-concept (PoC) for a critical authentication bypass vulnerability tracked as CVE-2026-55040. Patched in July’s Patch Tuesday, the flaw allows unauthenticated actors to impersonate SharePoint users by forging JSON Web Tokens (JWTs). Since the PoC surfaced, security researchers and telemetry providers have observed real-world attempts that underscore the urgency for administrators to apply updates and audit their environments.

What happened

Microsoft disclosed CVE-2026-55040 as a high-severity authentication feature bypass with a CVSS score of 9.1. The vendor’s advisory explains that the vulnerability could enable attackers to impersonate legitimate users, disclose files, and modify data on vulnerable SharePoint instances—though it does not appear to enable attacks against system availability. Rapid7 released a Python-based PoC that chains several weaknesses in SharePoint’s JWT validation pipeline, and threat actors quickly began leveraging that PoC in opportunistic scans and targeted queries.

How the exploit works

The outer JWT header uses “alg”: “none”, removing the requirement for a signature on the outer token.
The actor token carries an x5t header with SharePoint’s own STS certificate thumbprint, allowing a signing key to be resolved without proper verification.
The resolved certificate is not present in TrustedSecurityTokenServices, yet the issuer is still accepted.
The actor token contains a non-empty signature value (for example, AAAA) that is never actually verified by the vulnerable code.

Using this forged JWT, the PoC can query domain controllers, enumerate users by SID, and identify site administrators to escalate access and perform arbitrary operations as those users.

Evidence of active exploitation

Telemetry collected by KEVIntel recorded 12 exploitation attempts starting July 19, 2026, with a spike on August 12–13 that coincides with the PoC’s publication. The attempts originated from eight unique IP addresses across five regions, including Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. While attribution and the ultimate intent of the attackers remain unclear, the activity pattern indicates that public PoCs can rapidly accelerate abuse of high-impact flaws.

Implications for organizations

This vulnerability has several operational and security implications:

Rapid weaponization: The quick turnaround from PoC release to exploitation attempts highlights the need for timely patching and risk-based prioritization.
Impersonation risk: Because the flaw enables impersonation of site users and administrators, organizations face confidentiality and integrity risks—sensitive documents could be accessed or altered.
Detection challenges: The exploit leverages token mechanics that may blend into legitimate authentication traffic, making detection by naive indicators difficult.

Actionable steps for defenders:

Patch immediately: Ensure SharePoint servers are updated with Microsoft’s July 2026 fixes that address CVE-2026-55040.
Review logs: Look for anomalous authentication flows, unexpected JWT headers (such as “alg”: “none”), and unusual queries to domain controllers from SharePoint servers.
Restrict exposure: Limit public-facing SharePoint endpoints where possible and enforce network segmentation to reduce lateral movement opportunities.
Rotate credentials and keys: Where feasible, rotate service account credentials and review any delegated trust relationships that could be abused by forged tokens.
Threat hunting: Prioritize reviews for SID enumeration activities and queries that attempt to discover site administrators.

Lessons learned

The incident reinforces a few perennial lessons for enterprise security teams: public PoCs can precipitate immediate exploitation; complex authentication chains require defense-in-depth; and fast, prioritized patching combined with proactive detection and segmentation significantly reduces exposure. Organizations should also consider exercising token validation sanity checks and threat-hunting routines focused on authentication anomalies.

Conclusion

CVE-2026-55040 is a high-impact authentication bypass that can lead to impersonation and data exposure on vulnerable SharePoint installations. With Rapid7’s PoC publicly available and multiple exploitation attempts observed, administrators should prioritize patching, auditing authentication logs, and hardening access controls to mitigate the risk. Staying vigilant and responding swiftly to PoC disclosures remains essential to reducing the window of opportunity for attackers.