Attackers Exploit SharePoint Authentication Bypass as PoC Code Fuels Global Exploitation Surge

Threat actors are actively exploiting a critical Microsoft SharePoint vulnerability — CVE-2026-55040 — following the public release of proof-of-concept code this week, with 12 confirmed attack attempts recorded across five countries since July 19, 2026.

The speed of exploitation underscores a troubling pattern in modern cybersecurity: once working exploit code reaches the public domain, attackers waste no time. For organizations still running unpatched SharePoint instances, this vulnerability represents an open door to data theft and unauthorized administrative access — no credentials required.

---

What Makes This Vulnerability So Dangerous

CVE-2026-55040 carries a CVSS score of 9.1 — placing it firmly in the critical range — and was patched by Microsoft as part of its July 2026 Patch Tuesday update cycle. The flaw targets a fundamental part of how SharePoint authenticates users and services.

Microsoft described the risk in a security advisory issued last month: "The authentication feature could be bypassed as this vulnerability allows impersonation. Exploiting this vulnerability could allow an attacker to disclose files and modify data, but the attacker cannot impact the availability of the system."

That distinction matters but offers limited comfort. While attackers cannot take a SharePoint server offline through this flaw, they can impersonate any user — including site administrators — and freely access or alter sensitive files and data. In enterprise environments where SharePoint serves as a central document management and collaboration platform, that level of access can be devastating.

The technical root of the problem lies in the JWT token validation pipeline. According to Rapid7, which released the PoC earlier this week, the vulnerability chains four distinct weaknesses across two separate classes that handle Bearer service-to-service token logic: SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2.

Understanding why authentication vulnerabilities of this nature are so impactful requires appreciating how deeply SharePoint is embedded in enterprise workflows — serving as the backbone for document storage, internal communications, and access-controlled collaboration. A comprehensive vulnerability assessment of your organization's critical platforms is an essential step in identifying exposure before attackers do.

---

How the Exploit Chain Works

A Four-Step Attack Sequence Requiring Zero Authentication

Rapid7's research reveals a sophisticated but reproducible attack sequence that requires no authentication to execute. The exploit unfolds in four deliberate steps:

1. An attacker sends a JWT with "alg: none" in the outer header, meaning no signature is required on the outer token.
2. The actor token's x5t header contains SharePoint's own STS certificate thumbprint, allowing a signing key to be resolved without any verification.
3. The resolved certificate falls outside SharePoint's TrustedSecurityTokenServices, yet the issuer is still accepted.
4. The actor token's signature field contains a non-empty but completely unverified value — such as "AAAA" — allowing the forged token to pass validation entirely unchallenged.

Rapid7's Python-based PoC leverages this forged JWT to query a target's domain controller, enumerate users by Security Identifier (SID), and automatically locate a site administrator account. The exploit essentially uses the lock's own internal components to fabricate a master key — a scenario that would feel at home in a cyberpunk thriller like Mr. Robot, but is playing out in real enterprise networks right now.

Exploitation Activity Already Surging

Telemetry data from KEVIntel shows that eight of the 12 recorded exploitation attempts occurred on August 12 and 13, 2026 — the same period following Rapid7's PoC release. The attempts originated from eight unique IP addresses tied to five countries and regions: Hong Kong, Japan, the Netherlands, Taiwan, and the United States.

Cybersecurity firm Defused Cyber confirmed that threat actors are actively leveraging the Rapid7 PoC in real-world attacks. As of publication, the identity of those behind the exploitation activity and their ultimate objectives remain unknown.

---

A Growing SharePoint Problem in 2026

Five Actively Exploited SharePoint Vulnerabilities This Year

CVE-2026-55040 is the fifth SharePoint vulnerability to be actively exploited in 2026 alone. The four preceding it were CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522.

That pattern signals a sustained adversarial interest in SharePoint as a high-value target. Enterprise platforms that centralize sensitive documents and user communications present an attractive attack surface — particularly when authentication mechanisms can be bypassed before an attacker ever needs a valid password. Microsoft has published guidance on securing SharePoint Server that organizations should review alongside any patching activity.

What Organizations Should Do Immediately

Security researchers continue to monitor the situation. Organizations using SharePoint in on-premises environments face the most immediate risk and should treat this as a priority patching event rather than a routine update.

SharePoint users are strongly advised to apply the July 2026 Patch Tuesday updates immediately to close this vulnerability. For those who have not yet patched, the following actions are recommended:

• Review server access logs for unusual authentication activity — particularly JWT-related anomalies or unexpected administrative actions — which may help detect early compromise.
• Consider temporarily restricting external access to SharePoint instances until patches are fully deployed across your infrastructure.
• Audit privileged accounts and administrator-level access, since this exploit specifically targets the ability to impersonate site administrators.

Strengthening Authentication Across Your Environment

This vulnerability reinforces a broader lesson that extends well beyond SharePoint: authentication mechanisms are among the most actively targeted components of any enterprise platform. Enforcing multi-factor authentication across your critical systems adds a meaningful layer of defense that can limit the blast radius of authentication bypass exploits, even when underlying platform flaws are present.

For organizations managing public-facing SharePoint environments or broader web infrastructure, robust website security practices and controls should be reviewed in parallel with any emergency patching response — particularly given the speed at which active exploitation followed the PoC's public release.

Security teams should treat this not as a standalone incident, but as further evidence of a maturing threat landscape in which widely used enterprise collaboration platforms are primary targets, and the window between patch release and active exploitation continues to shrink.