SharePoint Authentication Bypass Comes Under Attack After PoC Disclosure

Threat actors have reportedly started targeting a critical Microsoft SharePoint vulnerability shortly after security researchers published proof-of-concept exploit code.

Tracked as CVE-2026-55040, the flaw carries a CVSS score of 9.1 and was addressed by Microsoft in its July 2026 security updates. The vulnerability is classified as an authentication bypass caused by weaknesses in SharePoint’s token-validation process. Microsoft said exploitation could allow an attacker to impersonate a user, read files, and alter data, although it does not provide a way to disrupt system availability.

According to Defused Cyber, attackers are using proof-of-concept code released by Rapid7 earlier in August. Rapid7’s analysis found that the issue results from multiple weaknesses in the handling of Bearer service-to-service tokens. In combination, those weaknesses can allow an unauthenticated remote attacker to construct a token that SharePoint accepts and use it to impersonate a site user, including an administrator.

Rapid7’s Python-based demonstration can query a target’s domain controller and enumerate user security identifiers, helping identify accounts with elevated SharePoint privileges. The research highlighted flaws involving token parsing, certificate handling, issuer validation, and signature verification.

Telemetry from KEVIntel recorded 12 suspected exploitation attempts beginning July 19. Eight occurred on August 12 and 13, shortly after the public PoC became available. The activity involved eight IP addresses linked to locations in Hong Kong, Japan, the Netherlands, Taiwan, and the United States. Researchers have not attributed the activity to a specific threat group or determined the attackers’ objectives.

Recommended action

Organizations running SharePoint should confirm that the July 2026 Microsoft updates have been installed across all affected servers. Administrators should also review authentication and web-server logs for unusual unauthenticated requests, unexpected account impersonation, or access to sensitive files. CVE-2026-55040 is reportedly the fifth SharePoint vulnerability observed in active exploitation during 2026, underscoring the need for rapid patch deployment and continued monitoring.