What Changed
Attackers are now exploiting CVE-2026-55040 (CVSS 9.1), a SharePoint Server authentication bypass that Microsoft patched in July, after Rapid7 published a proof-of-concept exploit. Defused Cyber says the attacks use Rapid7’s exploit. KEVIntel recorded 12 exploitation attempts since July 19, eight of them on August 12 and 13, from eight IP addresses in Hong Kong, Japan, the Netherlands, Taiwan and the U.S.
It is the fifth SharePoint flaw exploited this year, after CVE-2026-45659, CVE-2026-56164, CVE-2026-58644 and CVE-2026-50522.
How The Bypass Works
Rapid7 describes four weaknesses in SharePoint’s JWT validation for service-to-service tokens, in the SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2 classes. The outer token uses alg: none; its x5t value is the thumbprint of SharePoint’s own STS certificate; the issuer does not have to be a trusted token service; and the actor token’s signature is never verified. Together they let an unauthenticated attacker get past SharePoint authentication.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why This Is An Operations Problem
With working exploit code public, an unpatched internet-facing SharePoint server is an easy target. SharePoint holds sensitive documents and often connects to wider Microsoft infrastructure, so a bypass can be the first step of a larger intrusion.
What To Verify First
- Confirm the July SharePoint security updates are installed on every farm server.
- Review SharePoint and IIS logs for requests carrying bearer tokens from unexpected sources since mid-July.
- Check for new site administrators or unexpected permission changes.
What Teams May Be Underestimating
The gap between public PoC and attacks was a matter of days. For on-premises SharePoint, July’s update needs to be treated as an emergency change if it is still pending.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Related: see every Microsoft vulnerability CISA added to its exploited list in 2026, with the fix for each and links to our coverage.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Thursday’s brief: Cisco email gateways under attack, then PAN-OS, Nextcloud and AhsayCBS
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
