cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Attackers Exploit SharePoint Authentication Bypass CVE-2026-55040 After PoC Release

· Original article ↗

Summary

Attackers are exploiting SharePoint vulnerability CVE-2026-55040 after Rapid7 released a PoC. KEVIntel recorded 12 attempts since July 19, 2026; Microsoft patched the flaw in its July updates.

Key points

  • CVE-2026-55040 is a critical SharePoint authentication bypass (CVSS 9.1) attributed to weaknesses in JWT token validation.
  • Successful exploitation can let an unauthenticated remote attacker impersonate a SharePoint user or administrator.
  • Rapid7’s PoC chains four weaknesses to forge a JWT, including accepting an unsigned outer token and failing to verify a non-empty actor-token signature.
  • Rapid7’s Python PoC can query a target’s domain controller, enumerate users by SID, and locate a site administrator.
  • KEVIntel telemetry recorded 12 exploitation attempts since July 19, 2026; eight occurred on August 12–13 and came from eight IP addresses across five countries and regions.
  • The actors and their objectives are unknown. Microsoft says exploitation could disclose files and modify data but not affect system availability.
  • Microsoft patched the vulnerability in its July 2026 Patch Tuesday updates; SharePoint users are advised to update.

Article Details

Vulnerability Types
  • Authentication bypass
  • JWT token validation weakness
Severity
Critical (CVSS 9.1)
Exploitation Status
active
Exploit Availability
public_poc
Patch Status
available

MITRE ATT&CK

T1087.002 · Domain AccountRapid7's Python-based PoC queries a target's domain controller and enumerates users by SID to locate a site administrator.T1190 · Exploit Public-Facing ApplicationAttackers are actively exploiting CVE-2026-55040 against vulnerable SharePoint servers.

CVE

CVE-2026-55040Threat actors are actively exploiting CVE-2026-55040, a critical Microsoft SharePoint authentication bypass, after Rapid7 released proof-of-concept code.

Vendors

MicrosoftThreat actors are actively exploiting CVE-2026-55040, a critical Microsoft SharePoint authentication bypass, after Rapid7 released proof-of-concept code.

Products

Microsoft SharePointThreat actors are actively exploiting CVE-2026-55040, a critical Microsoft SharePoint authentication bypass, after Rapid7 released proof-of-concept code.

Countries

Hong KongThe 12 exploitation attempts have originated from eight unique IP addresses corresponding to five countries and regions, including Hong Kong, Japan, the Netherlands, Taiwan, and the U.S.JapanThe 12 exploitation attempts have originated from eight unique IP addresses corresponding to five countries and regions, including Hong Kong, Japan, the Netherlands, Taiwan, and the U.S.NetherlandsThe 12 exploitation attempts have originated from eight unique IP addresses corresponding to five countries and regions, including Hong Kong, Japan, the Netherlands, Taiwan, and the U.S.TaiwanThe 12 exploitation attempts have originated from eight unique IP addresses corresponding to five countries and regions, including Hong Kong, Japan, the Netherlands, Taiwan, and the U.S.United StatesThe 12 exploitation attempts have originated from eight unique IP addresses corresponding to five countries and regions, including Hong Kong, Japan, the Netherlands, Taiwan, and the U.S.

Related Articles