A critical authentication bypass vulnerability in Microsoft SharePoint Server Subscription Edition is under active exploitation following the public release of proof-of-concept code. CVE-2026-55040, which carries a CVSS score of 9.1, allows unauthenticated attackers to forge JSON Web Tokens (JWT) and impersonate any SharePoint user or administrator without valid credentials. Microsoft patched the vulnerability in its July 2026 Patch Tuesday release, but organizations that have not applied the update remain vulnerable.
The vulnerability stems from a chain of four weaknesses in SharePoint's JWT token validation pipeline. According to Rapid7's technical analysis, attackers can exploit the flaw by sending a JWT with an "alg: none" parameter in the outer header, eliminating the need for a valid signature. The exploit then uses SharePoint's own Security Token Service (STS) certificate thumbprint to resolve a signing key without proper verification, and passes a non-empty but unverified signature such as "AAAA." This combination allows SharePoint to accept the forged token as legitimate.
Rapid7 published a detailed technical writeup and Python-based proof-of-concept code on GitHub on August 12, 2026. The PoC automates the exploitation process by querying the target's domain controller, enumerating users by Security Identifier (SID), and automatically locating a site administrator account. Once attackers gain administrator-level access, they can read documents, modify data across the SharePoint farm, and potentially establish a foothold into broader Microsoft 365 infrastructure. While Microsoft's advisory notes that attackers cannot disrupt system availability, the ability to access and modify sensitive data poses significant risk.
Security researchers at Defused observed exploitation attempts against their SharePoint honeypots immediately after the PoC release. KEVIntel recorded 12 exploitation attempts since July 19, with eight occurring on August 12-13 alone, following the public disclosure. The attacks originated from eight IP addresses across Hong Kong, Japan, the Netherlands, Taiwan, and the United States. The sharp increase in activity after the PoC publication follows a familiar pattern where public exploit code dramatically reduces the time between patch availability and widespread exploitation attempts.
Organizations running SharePoint Server Subscription Edition should immediately apply the July 2026 Patch Tuesday update if they have not already done so. The combination of a critical severity rating, public exploit code, and confirmed active exploitation makes this vulnerability a high-priority remediation target. Security teams should also review SharePoint access logs for suspicious authentication activity and verify that all instances in their environment have been patched.
Source: https://securityaffairs.com/197137/hacking/sharepoint-cve-2026-55040-comes-under-attack-following-public-exploit.html