Attackers have started exploiting a critical vulnerability in Microsoft SharePoint after technical proof-of-concept code was made publicly available. The flaw, tracked as CVE-2026-55040, allows remote attackers to bypass authentication without having valid credentials. Microsoft fixed the issue through its July 2026 security updates, but the recent release of exploit details has increased concern for organizations that have not yet applied the patch.
CVE-2026-55040 is a security feature bypass vulnerability caused by weaknesses in SharePoint’s authentication process. Microsoft has rated the vulnerability as critical with a CVSS score of 9.1. An attacker who successfully abuses the flaw can impersonate a SharePoint user or administrator and carry out actions using that person’s level of access. The vulnerability affects supported on-premises SharePoint Server installations, including SharePoint Server 2016, 2019, and Subscription Edition.
The problem is linked to the way SharePoint validates JSON Web Tokens, commonly known as JWTs. According to Rapid7, several weaknesses in the token validation process can be combined to create a forged token that SharePoint accepts as legitimate. This means an attacker can potentially act as another user without first signing in normally. If the targeted account has administrator privileges, the impact can become much more serious because the attacker may gain access to sensitive SharePoint resources.
Rapid7 released technical details and a Python-based proof-of-concept for the vulnerability on August 11, 2026. The research team explained that its PoC can help identify SharePoint users through Active Directory information and then use the authentication bypass to impersonate a selected account. The research itself was part of a larger project that discovered two vulnerabilities capable of being chained together to achieve unauthenticated remote code execution against a vulnerable SharePoint server.
The public release appears to have been followed by real-world exploitation attempts. Telemetry cited by The Hacker News from KEVIntel recorded 12 exploitation attempts between July 19 and August 13, with eight of those attempts occurring on August 12 and 13. The activity came from eight unique IP addresses across Hong Kong, Japan, the Netherlands, Taiwan, and the United States. Security researchers have not yet confirmed who is responsible for the activity or what their final objectives are.
The vulnerability is particularly concerning because successful exploitation does not require the attacker to authenticate first. Once the authentication check is bypassed, the attacker can perform operations as the impersonated SharePoint user, including accessing files and modifying data. Microsoft has stated that exploitation can allow file disclosure and data modification, although the flaw itself does not allow an attacker to directly affect system availability.
Rapid7 also demonstrated that CVE-2026-55040 can be combined with another SharePoint vulnerability to form a more dangerous attack chain leading to unauthenticated remote code execution. Microsoft’s July patch for CVE-2026-55040 breaks that chain at the authentication-bypass stage. Rapid7 said the second vulnerability was expected to receive a fix during the August 2026 update cycle, highlighting why security teams should treat the authentication flaw as an important part of the wider attack path.
Organizations running on-premises SharePoint should therefore make patching CVE-2026-55040 a priority and verify that the required July security updates have been successfully installed. Security teams should also review SharePoint activity for unusual account usage, unexpected administrative actions, unauthorized file access, or other suspicious changes. The rapid shift from public PoC release to observed exploitation shows how quickly attackers can turn newly available vulnerability research into real attacks, making timely patching especially important.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
