Attacks on SharePoint: Public PoC Fuels Exploitation of an Authentication Bypass

Attackers have begun exploiting a recently disclosed vulnerability in Microsoft SharePoint after proof-of-concept code became publicly available. The flaw in question is CVE-2026-55040, rated 9.1 on the CVSS scale — a critical security-feature bypass tied to weak authentication. Microsoft patched the hole as part of its July 2026 “Patch Tuesday.”

In its advisory, the company explained that the vulnerability makes it possible to bypass authentication through identity spoofing: an attacker can disclose files and alter data, but cannot affect the system's availability.

How the Attack Works

According to Rapid7 — whose PoC the attackers picked up — the problem lies in the JWT token validation pipeline. The vulnerability combines four separate weaknesses across two classes responsible for parsing and validating service Bearer tokens (SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2), allowing an unauthenticated remote attacker to forge a valid token and impersonate any user of the site.

The chain looks like this: the outer token header specifies alg: none, so no signature is required at all. The x5t header of the inner token contains the thumbprint of SharePoint's own STS certificate, which makes it possible to locate the signing key without any verification. The certificate that is found is absent from the list of trusted services (TrustedSecurityTokenServices), yet the issuer is accepted anyway. Finally, the signature of the inner token can be any non-empty string, such as AAAA — no one checks it.

The Python PoC uses the forged token to reach the victim's domain controller, enumerate users by SID, and automatically find the site administrator's account.

The Scale of Exploitation

Who exactly is behind the attacks and what their goals are remains unknown. According to KEVIntel telemetry, 12 exploitation attempts have been recorded since July 19, 2026, with eight of them occurring on August 12 and 13 — that is, immediately after the PoC was published. The attempts originated from eight unique IP addresses spanning five countries and regions: Hong Kong, Japan, the Netherlands, Taiwan, and the United States.

Against the backdrop of this surge in activity, SharePoint administrators are strongly urged to install updates promptly — this remains the primary line of defense.

Source: The Hacker News