Menace actors have begun to take advantage of a newly disclosed Microsoft SharePoint vulnerability following the discharge of a proof-of-concept (PoC) code.
The vulnerability in query is CVE-2026-55040 (CVSS rating: 9.1), which refers to a essential safety function bypass that stems from weak authentication. It was patched by Microsoft as a part of its July 2026 Patch Tuesday updates.
“The authentication function might be bypassed as this vulnerability permits impersonation,” Microsoft mentioned in an advisory for the flaw final month. “Exploiting this vulnerability may permit an attacker to reveal recordsdata and modify knowledge, however the attacker can not affect the supply of the system.”
In line with Defused Cyber, menace actors are leveraging a PoC exploit launched by Rapid7 earlier this week, as soon as once more indicating recent flaws are being quickly abused in real-world assaults.
It is value mentioning that CVE-2026-55040 is the fifth SharePoint vulnerability to be exploited this yr after CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522.
Profitable exploitation of CVE-2026-55040 can permit an unauthenticated attacker to sidestep authentication on a susceptible SharePoint server and carry out arbitrary operations as a SharePoint website person or administrator. The vulnerability, per Rapid7, is because of “a number of points” within the JWT token validation pipeline.
Particularly, it chains 4 totally different weaknesses to permit an unauthenticated distant attacker to forge a sound JWT and impersonate any SharePoint website person. Rapid7 mentioned the problem resides in two totally different courses that implement the token parsing and validation logic for Bearer service-to-service (S2S) tokens –
- SPJsonWebSecurityTokenHandlerV2
- SPJsonWebSecurityBaseTokenHandlerV2
Your entire chain could be exploited by an attacker as follows –
- Attacker sends a JWT with “alg: none” within the outer header, so no signature is required within the outer token.
- The actor token’s x5t header accommodates SharePoint’s personal STS certificates thumbprint, making it doable to resolve a signing key with no verification.
- The resolved certificates isn’t in TrustedSecurityTokenServices, permitting the issuer to be accepted.
- The actor token’s signature is a non-empty worth, e.g., AAAA, which isn’t verified.
Rapid7’s Python-based PoC makes use of the cast JWT token to question a goal’s area controller, enumerate customers by SID, and auto-locate the SID for the person to discover a website administrator.
As of writing, it is unclear who’s behind the exploitation exercise or what their finish objectives are. Telemetry knowledge captured by KEVIntel reveals {that a} whole of 12 exploitation makes an attempt had been recorded since July 19, 2026. Out of those, eight passed off on August 12 and 13, 2026, indicating that the discharge of the PoC has performed a task in these efforts.
The 12 exploitation makes an attempt have originated from eight distinctive IP addresses corresponding to 5 nations and areas, together with Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. In mild of a spike in lively exploitation, SharePoint customers are suggested to maintain their cases up-to-date for optimum safety.
