SharePoint Under Siege: Critical Authentication Bypass Exploited Rapidly After PoC Release

The digital battleground is constantly shifting, and a recent development has put Microsoft SharePoint users on high alert. Threat actors are now actively exploiting a critical authentication bypass vulnerability, CVE-2026-55040, just days after a proof-of-concept (PoC) exploit was publicly released. This rapid weaponization underscores the urgent need for organizations to patch their systems immediately.

A Critical Flaw Unveiled: CVE-2026-55040

Identified with a severe CVSS score of 9.1, CVE-2026-55040 represents a significant security feature bypass rooted in weak authentication mechanisms within Microsoft SharePoint. Microsoft addressed this vulnerability as part of its July 2026 Patch Tuesday updates, warning that “The authentication feature could be bypassed as this vulnerability allows impersonation.” The advisory further clarified the potential impact: “Exploiting this vulnerability could allow an attacker to disclose files and modify data, but the attacker cannot impact the availability of the system.”

The Race Against Exploitation

Cybersecurity firm Defused Cyber has confirmed that malicious actors are already leveraging a PoC exploit, published by Rapid7 earlier this week. This swift transition from disclosure to active exploitation is a stark reminder of how quickly new vulnerabilities are integrated into real-world attack campaigns. Alarmingly, CVE-2026-55040 marks the fifth SharePoint vulnerability to be exploited this year, following a series of other critical flaws including CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522.

Unpacking the Impersonation Threat

At its core, successful exploitation of CVE-2026-55040 grants an unauthenticated attacker the ability to completely bypass authentication on a vulnerable SharePoint server. This allows them to perform arbitrary operations, effectively impersonating any SharePoint site user or even an administrator. The implications for data integrity and confidentiality are severe.

How Attackers Forge Identity: A Technical Breakdown

Rapid7’s analysis reveals that the vulnerability stems from “several issues” within SharePoint’s JSON Web Token (JWT) validation pipeline. Specifically, attackers can chain four distinct weaknesses to forge a valid JWT, enabling them to impersonate any legitimate SharePoint site user. The core of the problem lies in two classes responsible for token parsing and validation logic for Bearer service-to-service (S2S) tokens: SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2.

The exploitation chain unfolds as follows:

• An attacker crafts a JWT with "alg: none" in the outer header, circumventing the need for a signature on the outer token.
• The actor token’s x5t header is manipulated to contain SharePoint’s own STS certificate thumbprint, allowing a signing key to be resolved without proper verification.
• Despite the resolved certificate not being in TrustedSecurityTokenServices, the issuer is still accepted.
• Crucially, the actor token’s signature, even if it’s a non-empty placeholder like “AAAA”, is never actually verified.

Rapid7’s Python-based PoC demonstrates this by using the forged JWT to query a target’s domain controller, enumerate users by SID, and automatically locate the SID for a site administrator, illustrating a clear path to full compromise.

Global Exploitation Underway

While the identities and ultimate objectives of the attackers remain unclear, telemetry data from KEVIntel paints a concerning picture. Since July 19, 2026, a total of 12 exploitation attempts have been recorded. A significant surge occurred on August 12 and 13, 2026, with eight of these attempts taking place, strongly correlating with the public release of the PoC. These attacks originated from eight unique IP addresses across five countries and regions, including Hong Kong, Japan, the Netherlands, Taiwan, and the U.S., highlighting the global reach of this threat.

Urgent Call to Action

Given the confirmed active exploitation and the critical nature of this authentication bypass, all organizations utilizing Microsoft SharePoint are urged to prioritize patching their instances immediately. Keeping systems up-to-date is the most effective defense against such rapidly weaponized vulnerabilities and is crucial for maintaining optimal security posture.

Stay informed on the latest cybersecurity threats. Follow us on Google News, Twitter, and LinkedIn for exclusive content and critical updates.

For more details, visit our website.

Source: Link