Critical Microsoft SharePoint Authentication Bypass Exploited in the Wild Within Hours of Disclosure
Threat actors have rapidly weaponized a newly disclosed critical vulnerability in Microsoft SharePoint, launching attacks against internet-facing servers mere hours after security firm Rapid7 published a technical breakdown and proof-of-concept (PoC) exploit. The flaw, tracked as CVE-2026-55040 (CVSS 9.1), allows unauthenticated attackers to forge authentication tokens and impersonate any SharePoint user including administrators without requiring passwords or session cookies.
Rapid7 researcher Stephen Fewer detailed the exploit in a write-up, revealing that the vulnerability stems from four weaknesses in SharePoint’s JWT (JSON Web Token) validation pipeline. Attackers can craft a token with an "alg: none" header, bypass signature checks by leveraging SharePoint’s exposed security token service certificate, and submit a placeholder signature to trick the system into accepting the forged token. The PoC further automates the process by querying domain controllers to identify and impersonate site administrators.
Microsoft patched CVE-2026-55040 in its July 2026 Patch Tuesday update, describing it as a weak authentication issue enabling impersonation. Successful exploitation could allow attackers to disclose files and modify data, though system availability remains unaffected. The flaw impacts on-premises deployments including SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016 while SharePoint Online remains unaffected.
Despite the patch’s availability, researchers warn that thousands of unpatched, internet-exposed SharePoint servers remain vulnerable. The threat is compounded by the flaw’s potential chaining with CVE-2026-63520, a separate remote code execution vulnerability disclosed in Microsoft’s August 2026 Patch Tuesday, which could escalate attacks from impersonation to full system compromise.
Threat intelligence firm Defused confirmed active exploitation, noting that attackers were repurposing Rapid7’s PoC against exposed systems. Organizations are advised to apply the July and August 2026 security updates, restrict internet access to SharePoint servers, and monitor authentication logs for anomalous token activity.
Source: https://cybersecuritynews.com/microsoft-sharepoint-vulnerability-exploited-2/
Microsoft_SharePoint cybersecurity rating report: https://www.rankiteo.com/company/microsoft_sharepoint
"id": "MIC1786623910",
"linkid": "microsoft_sharepoint",
"type": "Vulnerability",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Thousands of unpatched, '
'internet-exposed SharePoint '
'servers',
'industry': 'Technology/Enterprise Software',
'location': 'Global',
'name': 'Microsoft SharePoint Server',
'type': 'Software'}],
'attack_vector': 'Internet-facing servers',
'data_breach': {'type_of_data_compromised': 'Files and data'},
'date_publicly_disclosed': '2026-07',
'description': 'Threat actors have rapidly weaponized a newly disclosed '
'critical vulnerability in Microsoft SharePoint, launching '
'attacks against internet-facing servers mere hours after '
'security firm Rapid7 published a technical breakdown and '
'proof-of-concept (PoC) exploit. The flaw, tracked as '
'CVE-2026-55040 (CVSS 9.1), allows unauthenticated attackers '
'to forge authentication tokens and impersonate any SharePoint '
'user including administrators without requiring passwords or '
'session cookies.',
'impact': {'data_compromised': 'Files disclosed and modified',
'operational_impact': 'Unauthenticated impersonation of users, '
'including administrators',
'systems_affected': 'Microsoft SharePoint Server (on-premises '
'deployments)'},
'initial_access_broker': {'high_value_targets': 'Site administrators'},
'post_incident_analysis': {'root_causes': 'Four weaknesses in SharePoint’s '
'JWT validation pipeline, including '
"'alg: none' header bypass and "
'exposed security token service '
'certificate'},
'recommendations': ['Apply the July and August 2026 security updates',
'Restrict internet access to SharePoint servers',
'Monitor authentication logs for anomalous token '
'activity'],
'references': [{'source': 'Rapid7'},
{'source': 'Microsoft'},
{'source': 'Defused'}],
'response': {'containment_measures': ['Apply July and August 2026 security '
'updates',
'Restrict internet access to SharePoint '
'servers'],
'enhanced_monitoring': 'Monitor authentication logs for '
'anomalous token activity',
'remediation_measures': ['Monitor authentication logs for '
'anomalous token activity']},
'title': 'Critical Microsoft SharePoint Authentication Bypass Exploited in '
'the Wild',
'type': 'Authentication Bypass',
'vulnerability_exploited': ['CVE-2026-55040', 'CVE-2026-63520']}