Attackers have started exploiting a critical Microsoft SharePoint vulnerability just days after researchers published proof-of-concept code showing how to abuse it, according to a report from The Hacker News published this week. The flaw, tracked as CVE-2026-55040 and carrying a severity score of 9.1, allows unauthenticated attackers to bypass authentication and impersonate SharePoint administrators. Microsoft patched the vulnerability in its July 2026 Patch Tuesday updates, but exploitation has surged since Rapid7 released working exploit code earlier this month.
The report documents 12 exploitation attempts recorded since July 19, 2026, with eight of those attempts occurring on August 12 and 13 alone. The attacks originated from eight unique IP addresses across five countries and regions: Hong Kong, Japan, the Netherlands, Taiwan, and the United States. CVE-2026-55040 marks the fifth SharePoint vulnerability exploited in 2026, following CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522. Successful exploitation enables an unauthenticated attacker to sidestep authentication on vulnerable SharePoint servers and carry out arbitrary operations as a SharePoint site user or administrator, though the attacker can't impact system availability.
According to Defused Cyber, threat actors are using the proof-of-concept exploit that Rapid7 released this week, demonstrating how quickly new flaws get abused in real-world attacks. Microsoft explained in its advisory that "the authentication feature could be bypassed as this vulnerability allows impersonation," and that exploiting it "could allow an attacker to disclose files and modify data." Rapid7's analysis reveals the vulnerability stems from multiple issues in the JWT token validation pipeline, specifically in two classes that handle token parsing and validation logic for Bearer service-to-service tokens: SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2.
The exploitation chain works by chaining four separate weaknesses to forge a valid JWT and impersonate any SharePoint site user. Rapid7's Python-based proof-of-concept sends a JWT with "alg: none" in the outer header so no signature is required, uses SharePoint's own STS certificate thumbprint in the actor token's x5t header to resolve a signing key without verification, ensures the resolved certificate isn't in TrustedSecurityTokenServices so the issuer gets accepted, and includes a non-empty but unverified signature value like AAAA in the actor token. The exploit code queries a target's domain controller, enumerates users by SID, and automatically locates the SID for the user to identify a site administrator. The spike in exploitation attempts following the PoC release suggests the public code has fueled attack activity, though it remains unclear who's behind the exploitation or what their objectives are.
In response to the rise in active exploitation, the report advises SharePoint users to keep their instances up-to-date for optimal protection. The concentration of attacks in mid-August points to how rapidly adversaries move once exploit code becomes publicly available. Organizations that delay patching critical authentication bypasses face the real prospect of unauthorized access to sensitive files and data, particularly when attackers can operate with administrator-level privileges. The pattern of five exploited SharePoint flaws in a single year highlights how the platform has become a consistent target for those seeking enterprise footholds.