- Threat actors are actively exploiting a critical Microsoft SharePoint vulnerability (CVE-2026-55040, CVSS 9.1) after a proof-of-concept code was released by Rapid7.
- The flaw allows unauthenticated attackers to bypass authentication, impersonate users, and perform arbitrary operations on vulnerable SharePoint servers.
- Twelve exploitation attempts have been recorded since July 19, 2026, with a spike on August 12-13, originating from Hong Kong, Japan, the Netherlands, Taiwan, and the U.S.
Threat actors have begun actively exploiting a newly disclosed Microsoft SharePoint vulnerability, CVE-2026-55040 (CVSS score 9.1), following the release of a proof-of-concept code by Rapid7. The critical security feature bypass, which stems from weak authentication, was patched by Microsoft as part of its July 2026 Patch Tuesday updates.
“The authentication feature could be bypassed as this vulnerability allows impersonation,” Microsoft said in its advisory. “Exploiting this vulnerability could allow an attacker to disclose files and modify data, but the attacker cannot impact the availability of the system.”
According to Defused Cyber, threat actors are leveraging the PoC exploit released by Rapid7, indicating fresh flaws are being abused in real-world attacks. Successful exploitation allows an unauthenticated attacker to sidestep authentication on a vulnerable SharePoint server and perform arbitrary operations as a site user or administrator.
The vulnerability, per Rapid7, is due to “several issues” in the JWT token validation pipeline. Specifically, it chains four different weaknesses to allow an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user. The issue resides in two classes that implement token parsing and validation logic for Bearer service-to-service tokens: SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2.
The exploitation chain involves sending a JWT with “alg: none” in the outer header, using SharePoint’s own STS certificate thumbprint in the x5t header, and providing a non-empty but unverified signature. Rapid7’s Python-based PoC uses the forged JWT token to query a target’s domain controller, enumerate users by SID, and auto-locate the SID for a site administrator.
As of writing, it’s unclear who is behind the exploitation activity or what their end goals are. Telemetry data captured by KEVIntel shows that a total of 12 exploitation attempts were recorded since July 19, 2026, with eight taking place on August 12 and 13, indicating the PoC release has played a role in these efforts. The 12 attempts originated from eight unique IP addresses across five countries and regions, including Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. SharePoint users are advised to keep their instances up-to-date for optimal protection.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- Bernstein Hikes Microsoft Target to $660, Bullish on AI
- Bitwise: Crypto valuations could double on buybacks, burns
- ASX shareholder seeks court approval to sue directors over blockchain failure
- AI pattern breaks Flock, Clearview, Axon cameras at Def Con
- Cerebras shares sink 15% as hardware revenue drops 23% in Q2
