Hackers Actively Exploiting Microsoft SharePoint Vulnerability Following PoC Release

Threat actors have wasted no time weaponizing a newly disclosed Microsoft SharePoint authentication bypass, launching real-world attacks against internet-facing servers just hours after security firm Rapid7 published a technical breakdown and proof-of-concept exploit for the flaw.

The vulnerability, tracked as CVE-2026-55040 and carrying a critical CVSS score of 9.1, allows a remote, unauthenticated attacker to forge a valid authentication token and impersonate any SharePoint user, including a site administrator, without ever needing a password or session cookie.

Threat intelligence firm Defused confirmed the exploitation trend after observing suspicious activity hitting its SharePoint honeypots, warning that attackers were “now using the @rapid7 POC for CVE-2026-55040” against exposed systems.

Rapid7 security researcher Stephen Fewer published a detailed write-up and an accompanying Python-based exploit script, laying bare exactly how the flaw can be abused, and within a day, defenders were seeing the same code repurposed for live attacks.

CVE-2026-55040 lives inside SharePoint’s JWT (JSON Web Token) validation pipeline, specifically in two internal classes called SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2 that handle Bearer service-to-service token parsing. Rapid7 found that four separate weaknesses combine to break authentication entirely.

How the Attack Works

First, an attacker can send a token with its outer header set to “alg: none,” meaning no signature is required at all. Second, the token’s x5t header can be pointed at SharePoint’s own security token service certificate thumbprint, which is exposed on an unauthenticated metadata endpoint, letting the server resolve a signing key without real verification.

Third, because that certificate isn’t listed in SharePoint’s TrustedSecurityTokenServices registry, the issuer gets accepted anyway. Finally, the signature field only needs to contain some non-empty value, such as a placeholder string, since the code never actually checks whether it’s cryptographically valid.

Chained together, these gaps let an attacker submit a self-issued token naming any account, including a domain administrator, and have SharePoint accept it as legitimate.

Rapid7’s PoC goes a step further by using the forged token to query a target’s domain controller, enumerate user accounts by SID, and automatically locate the site administrator account for full impersonation.

Microsoft quietly fixed CVE-2026-55040 during its July 2026 Patch Tuesday rollout, describing it in its advisory as a weak authentication issue where “the authentication feature could be bypassed as this vulnerability allows impersonation.”

The company noted that successful exploitation could let an attacker disclose files and modify data, though it would not affect system availability.

The flaw affects on-premises deployments only: SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. Cloud-hosted SharePoint Online is not impacted.

Despite the patch being available for roughly a month, security researchers warn that thousands of internet-facing SharePoint servers remain unpatched and exposed.

Notably, CVE-2026-55040 is also the first link in a more dangerous chain: when combined with a separate remote code execution flaw, CVE-2026-63520, disclosed alongside Microsoft’s August Patch Tuesday, an unauthenticated attacker could escalate from impersonation to full code execution on a vulnerable server.

Organizations running on-premises SharePoint should apply the July and August 2026 security updates immediately, restrict internet exposure of SharePoint servers, and monitor authentication logs for anomalous service-to-service token activity.

Given the speed at which this PoC has already been weaponized, unpatched, publicly reachable SharePoint deployments should be treated as an active, urgent risk.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.