Risk actors have begun to use a newly disclosed Microsoft SharePoint vulnerability following the discharge of a proof-of-concept (PoC) code.
The vulnerability in query is CVE-2026-55040 (CVSS rating: 9.1), which refers to a crucial safety characteristic bypass that stems from weak authentication. It was patched by Microsoft as a part of its July 2026 Patch Tuesday updates.
“The authentication characteristic could possibly be bypassed as this vulnerability permits impersonation,” Microsoft mentioned in an advisory for the flaw final month. “Exploiting this vulnerability may enable an attacker to reveal information and modify information, however the attacker can not impression the provision of the system.”
In accordance with Defused Cyber, risk actors are leveraging a PoC exploit launched by Rapid7 earlier this week, as soon as once more indicating contemporary flaws are being quickly abused in real-world assaults.
It is value mentioning that CVE-2026-55040 is the fifth SharePoint vulnerability to be exploited this yr after CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522.
Profitable exploitation of CVE-2026-55040 can enable an unauthenticated attacker to sidestep authentication on a susceptible SharePoint server and carry out arbitrary operations as a SharePoint web site consumer or administrator. The vulnerability, per Rapid7, is because of “a number of points” within the JWT token validation pipeline.
Particularly, it chains 4 completely different weaknesses to permit an unauthenticated distant attacker to forge a legitimate JWT and impersonate any SharePoint web site consumer. Rapid7 mentioned the problem resides in two completely different courses that implement the token parsing and validation logic for Bearer service-to-service (S2S) tokens –
- SPJsonWebSecurityTokenHandlerV2
- SPJsonWebSecurityBaseTokenHandlerV2
Your complete chain may be exploited by an attacker as follows –
- Attacker sends a JWT with “alg: none” within the outer header, so no signature is required within the outer token.
- The actor token’s x5t header incorporates SharePoint’s personal STS certificates thumbprint, making it attainable to resolve a signing key with no verification.
- The resolved certificates shouldn’t be in TrustedSecurityTokenServices, permitting the issuer to be accepted.
- The actor token’s signature is a non-empty worth, e.g., AAAA, which is rarely verified.
Rapid7’s Python-based PoC makes use of the cast JWT token to question a goal’s area controller, enumerate customers by SID, and auto-locate the SID for the consumer to discover a web site administrator.
As of writing, it is unclear who’s behind the exploitation exercise or what their finish targets are. Telemetry information captured by KEVIntel exhibits {that a} complete of 12 exploitation makes an attempt have been recorded since July 19, 2026. Out of those, eight passed off on August 12 and 13, 2026, indicating that the discharge of the PoC has performed a job in these efforts.
The 12 exploitation makes an attempt have originated from eight distinctive IP addresses corresponding to 5 nations and areas, together with Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. In gentle of a spike in lively exploitation, SharePoint customers are suggested to maintain their cases up-to-date for optimum safety.
