Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

What Changed

Attackers are now exploiting CVE-2026-55040 (CVSS 9.1), a SharePoint Server authentication bypass that Microsoft patched in July, after Rapid7 published a proof-of-concept exploit. Defused Cyber says the attacks use Rapid7’s exploit. KEVIntel recorded 12 exploitation attempts since July 19, eight of them on August 12 and 13, from eight IP addresses in Hong Kong, Japan, the Netherlands, Taiwan and the U.S.

It is the fifth SharePoint flaw exploited this year, after CVE-2026-45659, CVE-2026-56164, CVE-2026-58644 and CVE-2026-50522.

How The Bypass Works

Rapid7 describes four weaknesses in SharePoint’s JWT validation for service-to-service tokens, in the SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2 classes. The outer token uses alg: none; its x5t value is the thumbprint of SharePoint’s own STS certificate; the issuer does not have to be a trusted token service; and the actor token’s signature is never verified. Together they let an unauthenticated attacker get past SharePoint authentication.

Why This Is An Operations Problem

With working exploit code public, an unpatched internet-facing SharePoint server is an easy target. SharePoint holds sensitive documents and often connects to wider Microsoft infrastructure, so a bypass can be the first step of a larger intrusion.

What To Verify First

• Confirm the July SharePoint security updates are installed on every farm server.
• Review SharePoint and IIS logs for requests carrying bearer tokens from unexpected sources since mid-July.
• Check for new site administrators or unexpected permission changes.

What Teams May Be Underestimating

The gap between public PoC and attacks was a matter of days. For on-premises SharePoint, July’s update needs to be treated as an emergency change if it is still pending.

Source Context

This item was rebuilt from the following primary sources and original reporting:

• The Hacker News: Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

Related In The Daily Brief

See this item in The 5-Minute Cyber Brief

Related: see every Microsoft vulnerability CISA added to its exploited list in 2026, with the fix for each and links to our coverage.

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].

Keep Reading

Explore more →

Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis

ESET says UAC-0099 put a "nuclear weapon" request in VBScript malware to make AI tools refuse to analyze it. The…

Berlin confirms data theft after Rhysida ransomware attack claims

Berlin's Rhysida incident matters because it shows how quickly a public-sector cyber event becomes a data-governance and continuity problem once…

Hackers exploit critical Adobe Commerce flaw to hijack customer accounts

Attempts to exploit CVE-2026-71362 in Adobe Commerce and Magento have already been detected, and the flaw appears to let attackers…