SharePoint CVE-2026-55040 Under Active Attack After Rapid7 PoC Release

Threat actors are actively weaponizing a critical Microsoft SharePoint authentication bypass vulnerability, CVE-2026-55040, following the public release of a proof-of-concept (PoC) exploit by Rapid7. Patched as part of Microsoft's July 2026 Patch Tuesday, the flaw carries a CVSS score of 9.1 and stems from weak authentication logic that enables impersonation of legitimate SharePoint users. According to Microsoft, successful exploitation could allow attackers to disclose sensitive files and modify data on vulnerable servers, though availability would remain unaffected. Defused Cyber reports that exploitation activity has surged since Rapid7 published its PoC earlier this week, underscoring how quickly attackers operationalize newly disclosed flaws once exploit code becomes public.

The vulnerability resides in SharePoint's JWT token validation pipeline and chains four distinct weaknesses across two classes — SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2 — that govern Bearer service-to-service (S2S) token parsing and verification. The exploit works by sending a JWT with "alg: none" in the outer header, eliminating the signature requirement, while embedding SharePoint's own STS certificate thumbprint in the actor token's x5t header. This enables key resolution without verification, and because the resolved certificate is not part of TrustedSecurityTokenServices, the issuer is accepted. A non-empty placeholder signature such as "AAAA" is never validated, completing the forgery chain. Rapid7's Python-based PoC leverages the forged JWT to query a domain controller, enumerate users by SID, and automatically locate the site administrator's identifier.

Telemetry captured by KEVIntel reveals 12 exploitation attempts originating from eight unique IP addresses across Hong Kong, Japan, the Netherlands, Taiwan, and one additional country, with eight of those attempts concentrated on August 12 and 13 — directly correlating with the PoC's release. The identity and motives of the threat actors remain unknown. CVE-2026-55040 is the fifth SharePoint vulnerability actively exploited in 2026, following CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522. Organizations running unpatched SharePoint servers should prioritize applying the July 2026 update immediately, use a port scanner to identify any internet-exposed SharePoint instances, and audit authentication logs for signs of suspicious JWT activity. Security teams should also run a WHOIS lookup on any suspicious source IPs and verify their exposure profile with a comprehensive privacy checkup to harden their overall attack surface.