Microsoft SharePoint — Active Exploitation of Authentication Bypass Following Public PoC Release (CVE-2026-55040)

Publication date: August 13, 2026
Category: Vulnerability / Enterprise Security

Introduction

Threat actors have started actively exploiting a critical authentication bypass vulnerability in Microsoft SharePoint, tracked as CVE-2026-55040, following the public release of a Python-based proof-of-concept (PoC) exploit code by security firm Rapid7. The vulnerability, originally patched by Microsoft as part of the July 2026 Patch Tuesday update cycle, enables unauthenticated attackers to perform arbitrary operations and impersonate site users or administrators on vulnerable SharePoint servers by forging JSON Web Tokens (JWT).

What is CVE-2026-55040? (General Analysis)

CVE-2026-55040 is a security feature bypass vulnerability stemming from weak authentication in Microsoft Office SharePoint. The affected component handles service-to-service (S2S) token validation using Bearer tokens.

From a metric and taxonomic perspective, this flaw is defined by the following confirmed facts:

• CVSS Score and Vector (v3.1): 9.1 (CRITICAL) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• CWE Classification: CWE-1390 (Weak Authentication)
• CISA KEV Status: Listed in the Known Exploited Vulnerabilities Catalog.

The critical risk lies in the fact that an unauthenticated remote attacker with no required user interaction can bypass access control mechanisms, compromising the confidentiality and integrity of the platform by accessing and modifying sensitive enterprise data stored across SharePoint sites.

How Does It Work? (Technical Analysis)

The exploitation mechanism uncovered by Rapid7 and mirrored by threat actors relies on chaining multiple logical flaws within SharePoint’s JWT token validation pipeline. Specifically, the flaw resides in two distinct classes implementing token parsing and validation logic for S2S Bearer tokens: SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2.

The technical attack chain proceeds through the following steps:

• Outer Header Manipulation (alg: none): The attacker submits a JWT configured with alg: none in the outer header, bypassing the requirement for a valid cryptographic signature.
• Abuse of the x5t Parameter: The actor token’s x5t header contains SharePoint’s own Secure Token Service (STS) certificate thumbprint, enabling the resolution of a signing key without rigorous validation.
• Bypassing Issuer Trust: The resolved certificate is not validated against TrustedSecurityTokenServices, allowing the issuer to be accepted by default.
• Unverified Signature: The actor token includes a non-empty arbitrary signature value (e.g., AAAA), which is never actually verified by the handler.

Leveraging these logical bypasses, Rapid7’s PoC interacts with domain controllers to enumerate corporate users via Security Identifiers (SIDs) and automatically locate site administrator accounts.

Summary Table of Related SharePoint Vulnerabilities (2026)

Affected Systems / Environments

• Affected Software: On-premises instances of Microsoft Office SharePoint Server missing cumulative security patches released by Microsoft from July 2026 onward.
• Impacted Platforms: Enterprise and hybrid environments integrating SharePoint with Active Directory / Azure AD identity services.
• Geographic Scope and Telemetry: Telemetry data captured by KEVIntel recorded 12 exploitation attempts since July 19, 2026, with a sharp spike on August 12 and 13 following PoC publication, originating from 8 unique IP addresses across Hong Kong, Japan, the Netherlands, Taiwan, and the U.S.

Mitigation and Detection

Remediation

• Immediately apply official cumulative update bulletins provided by Microsoft corresponding to the July 2026 patch cycle.
• Restrict public internet exposure of SharePoint servers using secure Web Application Firewalls (WAF) and corporate VPNs.
• Audit authentication logs for anomalous S2S requests utilizing JWT tokens with suspicious headers (alg: none).

Detection

• Monitor incoming HTTP requests targeting SharePoint endpoints that process Bearer authentication and S2S tokens with anomalous structures.
• Analyze Windows Event Logs for unusual queries directed toward domain controllers originating from the SharePoint server role.

Operational Warning: The availability of functional exploitation scripts in public repositories dramatically increases the likelihood of mass scanning and automated attacks targeting internet-exposed SharePoint servers. Defensive teams must prioritize patch validation.

Wrapping Up

The rapid transition from vulnerability disclosure to active field exploitation — catalyzed by Rapid7’s release of a functional PoC — highlights the urgency of patch management in critical enterprise environments. CVE-2026-55040 emphasizes the inherent risks associated with complex logic implementations in JWT token validation, requiring organizations to maintain a proactive posture in vulnerability management and continuous monitoring of exposed infrastructure.

References

• Lakshmanan, R. (2026). Attackers Exploit SharePoint Authentication Bypass After Public PoC Release. The Hacker News. https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html
• Rapid7. (2026). Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040). https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/
• GitHub. (2026). Python-based PoC for CVE-2026-55040. https://github.com/sfewer-r7/CVE-2026-55040
• KEVIntel. (2026). Telemetry Data on CVE-2026-55040 Exploitation. https://kevintel.com/CVE-2026-55040
• Microsoft. (2026). Microsoft Security Update Guide: CVE-2026-55040 Vulnerability. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040
• Cybersecurity and Infrastructure Security Agency (CISA). (2026). Known Exploited Vulnerabilities Catalog (CVE-2026-55040, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522). https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Microsoft. (2026). Microsoft Security Update Guide: CVE-2026-45659 Vulnerability. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659
• Microsoft. (2026). Microsoft Security Update Guide: CVE-2026-56164 Vulnerability. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164
• Microsoft. (2026). Microsoft Security Update Guide: CVE-2026-58644 Vulnerability. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644
• Microsoft. (2026). Microsoft Security Update Guide: CVE-2026-50522 Vulnerability. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522