Menace actors have begun to use a newly disclosed Microsoft SharePoint vulnerability following the discharge of a proof-of-concept (PoC) code.
The vulnerability in query is CVE-2026-55040 (CVSS rating: 9.1), which refers to a essential safety function bypass that stems from weak authentication. It was patched by Microsoft as a part of its July 2026 Patch Tuesday updates.
“The authentication function could possibly be bypassed as this vulnerability permits impersonation,” Microsoft mentioned in an advisory for the flaw final month. “Exploiting this vulnerability might permit an attacker to reveal recordsdata and modify information, however the attacker can’t impression the provision of the system.”
In line with Defused Cyber, risk actors are leveraging a PoC exploit launched by Rapid7 earlier this week, as soon as once more indicating recent flaws are being abused in real-world assaults.
Profitable exploitation of CVE-2026-55040 can permit an unauthenticated attacker to sidestep authentication on a susceptible SharePoint server and carry out arbitrary operations as a SharePoint web site consumer or administrator. The vulnerability, per Rapid7, is because of “a number of points” within the JWT token validation pipeline.
Particularly, it chains 4 totally different weaknesses to permit an unauthenticated distant attacker to forge a legitimate JWT and impersonate any SharePoint web site consumer. Rapid7 mentioned the problem resides in two totally different lessons that implement the token parsing and validation logic for Bearer service-to-service (S2S) tokens –
- SPJsonWebSecurityTokenHandlerV2
- SPJsonWebSecurityBaseTokenHandlerV2
All the chain could be exploited by an attacker as follows –
- Attacker sends a JWT with “alg: none” within the outer header, so no signature is required within the outer token.
- The actor token’s x5t header comprises SharePoint’s personal STS certificates thumbprint, making it potential to resolve a signing key with no verification.
- The resolved certificates just isn’t in TrustedSecurityTokenServices, permitting the issuer to be accepted.
- The actor token’s signature is a non-empty worth, e.g., AAAA, which is rarely verified.
Rapid7’s Python-based PoC makes use of the cast JWT token to question a goal’s area controller, enumerate customers by SID, and auto-locate the SID for the consumer to discover a web site administrator.
As of writing, it is unclear who’s behind the exploitation exercise or what their finish targets are. Telemetry information captured by KEVIntel exhibits {that a} complete of 12 exploitation makes an attempt have been recorded since July 19, 2026. Out of those, eight passed off on August 12 and 13, 2026, indicating that the discharge of the PoC has performed a job in these efforts.
The 12 exploitation makes an attempt have originated from eight distinctive IP addresses corresponding to 5 international locations and areas, together with Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. In gentle of a spike in lively exploitation, SharePoint customers are suggested to maintain their situations up-to-date for optimum safety.
